# Contest Gallery Pro

> Not on WordPress.org: a premium or commercial plugin that updates from its vendor.

Source: https://todaywp.com (Today WP, free and read-only). 

## Facts

- Slug: contest-gallery-pro
- To check an installed version: wp_security with plugins "contest-gallery-pro:<version>".

## Known vulnerabilities

- 2026-06-01 CRITICAL: Unauthenticated Privilege Escalation (up to 29.0.1). CVE-2026-42680, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8b443bb-4b23-48a1-9859-953b3cd84ca6?source=api-prod
- 2022-12-05 HIGH: Unauthenticated SQL Injection via cg_Fields (up to 19.1.4.1). WF-10e05707-02cb-42de-8399-4556d76b01b3-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/10e05707-02cb-42de-8399-4556d76b01b3?source=api-prod
- 2022-12-05 HIGH: Unauthenticated SQL Injection via user_id (up to 19.1.5). WF-1a0fa7f6-cc1a-45fe-881d-694c81b841c7-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0fa7f6-cc1a-45fe-881d-694c81b841c7?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_option_id (up to 19.1.4.1). WF-213fde1b-13dc-442a-8f48-4b1074155a6f-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/213fde1b-13dc-442a-8f48-4b1074155a6f?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via wp_user_id (up to 19.1.4.1). WF-250788a8-55d1-416b-bf1c-2170e8483ccc-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/250788a8-55d1-416b-bf1c-2170e8483ccc?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_multiple_files_for_post (up to 19.1.4.1). WF-3b1b1a55-7872-456f-a754-023aad354359-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1b1a55-7872-456f-a754-023aad354359?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_copy_id (up to 19.1.4.1). WF-3e9672b1-6d00-45bc-91ef-0c5583b5306e-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9672b1-6d00-45bc-91ef-0c5583b5306e?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_copy_start (up to 19.1.4.1). WF-407d8ebe-f3fc-433a-856f-de2ad4e58b9e-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/407d8ebe-f3fc-433a-856f-de2ad4e58b9e?source=api-prod
- 2022-12-05 MEDIUM: Authenticated (Administrator+) SQL Injection via wp_user_id (up to 19.1.4.1). CVE-2022-4154, https://www.wordfence.com/threat-intel/vulnerabilities/id/4284c31c-fa58-49fe-89ed-35d7b1bd6ec8?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via option_id GET (up to 19.1.4.1). WF-691eb4c1-18ba-433b-8725-70f2ecf89b0a-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/691eb4c1-18ba-433b-8725-70f2ecf89b0a?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_order (up to 19.1.4.1). WF-6f946251-c7be-4ef6-885f-8b378c0c234c-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f946251-c7be-4ef6-885f-8b378c0c234c?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_row (up to 19.1.4.1). WF-75c6697c-bc1d-456f-baee-ee9c57e40d21-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/75c6697c-bc1d-456f-baee-ee9c57e40d21?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_id (up to 19.1.5). WF-b24625d7-2a38-451b-ab79-a1d9c5b8822a-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/b24625d7-2a38-451b-ab79-a1d9c5b8822a?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via upload[] (up to 19.1.5). WF-cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8?source=api-prod
- 2022-12-05 HIGH: SQL Injection via option_id (up to 19.1.5). WF-e7fcda2b-d679-44af-9592-4a96a0115a08-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fcda2b-d679-44af-9592-4a96a0115a08?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via addCountS (up to 19.1.4.1). WF-f185709e-0d13-48d3-9c15-03466b72dac2-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/f185709e-0d13-48d3-9c15-03466b72dac2?source=api-prod
- 2022-11-29 HIGH: Authenticated (Author+) SQL Injection via option_id (up to 19.1.4.1). WF-31196bdf-2ddd-49ea-840d-8fd78611629e-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/31196bdf-2ddd-49ea-840d-8fd78611629e?source=api-prod
- 2022-11-29 HIGH: Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate (up to 19.1.4.1). WF-5d080f5b-6646-47ef-8ae7-8b94270f9f59-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d080f5b-6646-47ef-8ae7-8b94270f9f59?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.