Contest Gallery
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:contest_gallery:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Contest Gallery (2eccafda-a1c4-523c-ba3c-22c92ba5c134) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16055 |
vulnerable | 2026-09-16 04:32:57.152025 |
Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication Contest Gallery WordPress plugin before 30.0.7 and enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.
Published: 2026-08-05T06:00:12.744Z
Updated: 2026-08-05T14:04:53.010Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16056 |
vulnerable | 2026-09-16 04:32:56.562113 |
Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire stored OpenAI prompt history.
Published: 2026-08-04T06:00:11.408Z
Updated: 2026-08-04T17:38:24.784Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16057 |
vulnerable | 2026-09-16 04:32:56.479568 |
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.
Published: 2026-08-03T06:00:10.227Z
Updated: 2026-08-04T17:42:06.222Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4166 |
vulnerable | 2026-06-08 05:51:36.917929 |
Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Published: 2022-12-26T12:28:04.308Z
Updated: 2025-04-11T23:13:55.632Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4165 |
vulnerable | 2026-06-08 05:51:36.917407 |
Contest Gallery < 19.1.5 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Published: 2022-12-26T12:28:01.816Z
Updated: 2025-04-11T23:20:05.228Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4164 |
vulnerable | 2026-06-08 05:51:36.916985 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4163 |
vulnerable | 2026-06-08 05:51:36.916243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4162 |
vulnerable | 2026-06-08 05:51:36.915674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4161 |
vulnerable | 2026-06-08 05:51:36.915257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4160 |
vulnerable | 2026-06-08 05:51:36.914693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4159 |
vulnerable | 2026-06-08 05:51:36.914100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4158 |
vulnerable | 2026-06-08 05:51:36.913588 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4157 |
vulnerable | 2026-06-08 05:51:36.912981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4156 |
vulnerable | 2026-06-08 05:51:36.912367 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4155 |
vulnerable | 2026-06-08 05:51:36.911835 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4153 |
vulnerable | 2026-06-08 05:51:36.910866 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4152 |
vulnerable | 2026-06-08 05:51:36.910315 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4151 |
vulnerable | 2026-06-08 05:51:36.909555 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4150 |
vulnerable | 2026-06-08 05:51:36.906965 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.