Plugin security history

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 60 vulnerability records associated with Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe, published between 2019 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

60Total records

5Critical

27High

28Medium

0Low

0Informational

60Patched records

0Currently marked unpatched

2019-06-12First disclosure

2026-07-27Latest disclosure

57 of 60CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	1	1 records
2021	2	2 records
2022	20	20 records
2023	2	2 records
2024	12	12 records
2025	10	10 records
2026	13	13 records

Severity Breakdown

Severity	Records	Share
Critical	5	8.3%
High	27	45%
Medium	28	46.7%

Vulnerability-Type Breakdown

SQL Injection

26 records43.3%

First: 2022. Latest: 2026.

Cross-Site Scripting

17 records28.3%

First: 2021. Latest: 2026.

Missing Authorization

5 records8.3%

First: 2024. Latest: 2026.

CSRF

4 records6.7%

First: 2019. Latest: 2025.

Information Disclosure

3 records5%

First: 2021. Latest: 2026.

Privilege Escalation

2 records3.3%

First: 2024. Latest: 2026.

Other

2 records3.3%

First: 2025. Latest: 2026.

Authentication Bypass

1 record1.7%

First: 2026. Latest: 2026.

Patch Status

Patched: 60
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

30.0.7
30.0.1
30.0.3
28.1.7
29.0.0
28.1.6
28.1.3
28.1.2.2
28.1.5
28.1.2
28.0.3
28.0.1
28.0.0
27.0.3
26.1.1
26.0.7
26.0.9
26.0.1
25.1.2
24.0.4
24.0.8
23.1.3
21.3.6
21.3.5
21.3.2.1
21.3.1
21.2.9
21.2.8.1
21.1.2.1
19.1.5.1
19.1.5
17.0.5
13.1.0.6
14.0.0
13.1.0.7
10.4.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-30.0.6`	Contest Gallery <= 30.0.6 - Unauthenticated Stored Cross-Site Scripting	July 27, 2026	30.0.7	High
`*-30.0.0`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection	June 26, 2026	30.0.1	Medium
`*-30.0.2`	Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter	June 16, 2026	30.0.3	High
`*-28.1.6`	Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection	May 18, 2026	28.1.7	High
`*-28.1.7`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure	April 29, 2026	29.0.0	Medium
`*-28.1.6`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting	April 29, 2026	29.0.0	Medium
`*-28.1.7`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization	April 29, 2026	29.0.0	Medium
`*-28.1.6`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection	April 21, 2026	28.1.7	High
`*-28.1.5`	Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion	March 23, 2026	28.1.6	High
`*-28.1.2.2`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 - Missing Authorization	March 23, 2026	28.1.3	Medium
`*-28.1.2.1`	Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery	March 10, 2026	28.1.2.2	Medium
`*-28.1.4`	Contest Gallery <= 28.1.4 - Unauthenticated SQL Injection	March 2, 2026	28.1.5	High
`*-28.1.1`	Contest Gallery <= 28.1.1 - Missing Authorization	January 9, 2026	28.1.2	Medium
`*-28.0.2`	Contest Gallery <= 28.0.2 - Missing Authorization	November 14, 2025	28.0.3	Medium
`*-28.0.0`	Contest Gallery <= 28.0.0 - Cross-Site Request Forgery	October 12, 2025	28.0.1	Medium
`*-27.0.3`	Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection	October 10, 2025	28.0.0	Medium
`*-27.0.2`	Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting	October 3, 2025	27.0.3	Medium
`*-26.1.0`	Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting	July 31, 2025	26.1.1	High
`*-26.0.6`	Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting	July 11, 2025	26.0.7	Medium
`*-26.0.8`	Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting	July 10, 2025	26.0.9	Medium
`*-26.0.6`	Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	May 7, 2025	26.0.7	Medium
`*-26.0.0.1`	Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting	February 27, 2025	26.0.1	High
`*-25.1.0`	Contest Gallery <= 25.1.0 - Authenticated (Author+) SQL Injection	January 31, 2025	25.1.2	Medium
`*-24.0.3`	Contest Gallery <= 24.0.3 - Authenticated (Author+) Stored Cross-Site Scripting	December 30, 2024	24.0.4	Medium
`*-24.0.7`	Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover	November 27, 2024	24.0.8	Critical

Selected source records

Latest Records

HighCVE-2026-65447

Contest Gallery <= 30.0.6 - Unauthenticated Stored Cross-Site Scripting

Published: July 27, 2026

Affected versions: *-30.0.6
Patched versions: 30.0.7

Original Wordfence record

MediumCVE-2026-57662

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 30.0.0 - Authenticated (Contributor+) SQL Injection

Published: June 26, 2026

Affected versions: *-30.0.0
Patched versions: 30.0.1

Original Wordfence record

HighCVE-2026-12165

Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter

Published: June 16, 2026

Affected versions: *-30.0.2
Patched versions: 30.0.3

Original Wordfence record

HighCVE-2026-8912

Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection

Published: May 18, 2026

Affected versions: *-28.1.6
Patched versions: 28.1.7

Original Wordfence record

MediumCVE-2026-42657

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Missing Authorization

Published: April 29, 2026

Affected versions: *-28.1.7
Patched versions: 29.0.0

Original Wordfence record

MediumCVE-2026-42656

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: April 29, 2026

Affected versions: *-28.1.6
Patched versions: 29.0.0

Original Wordfence record

MediumCVE-2026-42660

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.7 - Authenticated (Subscriber+) Sensitive Information Exposure

Published: April 29, 2026

Affected versions: *-28.1.7
Patched versions: 29.0.0

Original Wordfence record

HighCVE-2026-40771

Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.6 - Unauthenticated SQL Injection

Published: April 21, 2026

Affected versions: *-28.1.6
Patched versions: 28.1.7

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-30238

Photos and Files Contest Gallery <= 21.3.2 - Authenticated (Contributor+) SQL Injection

Published: March 26, 2024

Affected versions: *-21.3.2
Patched versions: 21.3.2.1

Original Wordfence record

CriticalCVE-2024-30236

Photos and Files Contest Gallery <= 21.3.4 - Authenticated (Contributor+) SQL Injection

Published: March 26, 2024

Affected versions: *-21.3.4
Patched versions: 21.3.5

Original Wordfence record

CriticalCVE-2024-11103

Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover

Published: November 27, 2024

Affected versions: *-24.0.7
Patched versions: 24.0.8

Original Wordfence record

CriticalCVE-2021-24915

Contest Gallery – Photo Contest Plugin for WordPress <= 13.1.0.5 - SQL Injection

Published: April 13, 2022

Affected versions: *-13.1.0.5
Patched versions: 13.1.0.6

Original Wordfence record

CriticalCVE-2024-10687

Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection

Published: November 4, 2024

Affected versions: *-24.0.3
Patched versions: 24.0.4

Original Wordfence record

HighCVE-2026-12165

Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter

Published: June 16, 2026

Affected versions: *-30.0.2
Patched versions: 30.0.3

Original Wordfence record

HighCVE-2022-4150

Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id

Published: December 5, 2022

Affected versions: *-19.1.5
Patched versions: 19.1.5.1

Affected versions: *-19.1.5
Patched versions: 19.1.5.1

Original Wordfence record

HighCVE-2022-36394

Contest Gallery <= 17.0.4 - Authenticated (Author+) SQL Injection

Published: August 9, 2022

Affected versions: *-17.0.4
Patched versions: 17.0.5

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory