# Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe

> Create photo and media galleries with uploads, voting and product sales through PayPal or Stripe.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:29 UTC.

## Facts (WordPress.org)

- Slug: `contest-gallery`
- Author: Wasiliy Strecker / ContestGallery developer
- Version: 34.0.5
- Active installs: 1,000+
- Last update: 2026-11-12 (2 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.6, PHP 5.6
- Tags: file upload, gallery, photo contest, User Registration, voting
- Page: https://wordpress.org/plugins/contest-gallery/

## Checks (against WordPress 7.1.4)

- OK: Updated 2 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready.

## Known vulnerabilities

- 2026-11-11 HIGH: Authenticated (Author+) Arbitrary File Upload (before 34.0.3). CVE-2026-118041, https://www.wordfence.com/threat-intel/vulnerabilities/id/acd22b79-1354-4dc8-9475-ac5312b057e9?source=api-prod
- 2026-10-21 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 34.0.1). CVE-2026-111837, https://www.wordfence.com/threat-intel/vulnerabilities/id/bea33fd8-47ee-47ae-a6b4-5aa44f417b1e?source=api-prod
- 2026-10-21 MEDIUM: Missing Authorization (before 34.0.1). CVE-2026-107447, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b74ae4d-d353-497a-9364-6fdbee7e0815?source=api-prod
- 2026-10-10 MEDIUM: Unauthenticated Unauthorized Account Activation (up to 33.0.0). CVE-2026-107120, https://www.wordfence.com/threat-intel/vulnerabilities/id/dbebafeb-b7d5-4f5f-8ae3-3444bf5d1361?source=api-prod
- 2026-09-16 HIGH: Unauthenticated Arbitrary File Upload  via 'baseUrlForFacebook' Parameter (up to 32.0.1). CVE-2026-78088, https://www.wordfence.com/threat-intel/vulnerabilities/id/af2115ba-5573-41ce-8d5a-58c57c65c75a?source=api-prod
- 2026-08-19 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 30.0.5). CVE-2026-61986, https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f308cc-2ea9-4c67-9c1b-4f2e4676b2c2?source=api-prod
- 2026-08-15 MEDIUM: Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' (up to 30.0.7). CVE-2026-16586, https://www.wordfence.com/threat-intel/vulnerabilities/id/294e1822-b92c-48a4-bfc6-5a89cfbe0bc7?source=api-prod
- 2026-08-05 MEDIUM: Unauthenticated Two-Factor Authentication Bypass (up to 30.0.6). CVE-2026-16055, https://www.wordfence.com/threat-intel/vulnerabilities/id/6c172399-b443-414d-85a7-7d91acaf1774?source=api-prod
- 2026-08-04 MEDIUM: Missing Authorization (up to 30.0.6). CVE-2026-16056, https://www.wordfence.com/threat-intel/vulnerabilities/id/078603e7-d597-4090-9c53-14ed98674269?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization (up to 30.0.6). CVE-2026-16057, https://www.wordfence.com/threat-intel/vulnerabilities/id/37f0cb8f-80c7-457a-a92f-9cd6ad65c443?source=api-prod
- 2026-07-27 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 30.0.6). CVE-2026-65447, https://www.wordfence.com/threat-intel/vulnerabilities/id/01acb93b-89ae-4024-9f43-5fd14a7bd5f6?source=api-prod
- 2026-06-26 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 30.0.0). CVE-2026-57662, https://www.wordfence.com/threat-intel/vulnerabilities/id/181f578f-011b-4819-8b4d-1e7e78176e10?source=api-prod
- 2026-06-17 HIGH: Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter (up to 30.0.2). CVE-2026-12165, https://www.wordfence.com/threat-intel/vulnerabilities/id/69b909da-b1b0-4dab-916c-908511f6556f?source=api-prod
- 2026-06-15 HIGH: Unauthenticated SQL Injection (up to 28.1.6). CVE-2026-40771, https://www.wordfence.com/threat-intel/vulnerabilities/id/768d0d53-8724-4598-ae73-305225b52633?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 28.1.6). CVE-2026-42656, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1525119-732d-4948-9c33-75e9f3517c0d?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 28.1.7). CVE-2026-42657, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c2482cc-1717-4fae-b45b-3a1a1ce95fdc?source=api-prod
- 2026-06-15 MEDIUM: Authenticated (Subscriber+) Sensitive Information Exposure (up to 28.1.7). CVE-2026-42660, https://www.wordfence.com/threat-intel/vulnerabilities/id/a443e857-a915-4aa4-9879-1465d50544cc?source=api-prod
- 2026-05-19 HIGH: Unauthenticated SQL Injection (up to 28.1.6). CVE-2026-8912, https://www.wordfence.com/threat-intel/vulnerabilities/id/71f2f8c4-00ee-4ab4-b0e0-9ddac46818b3?source=api-prod
- 2026-03-23 MEDIUM: Missing Authorization (up to 28.1.2.2). CVE-2026-25035, https://www.wordfence.com/threat-intel/vulnerabilities/id/07f16cf7-94ad-4203-9d71-8e6e349d8c89?source=api-prod
- 2026-03-23 HIGH: Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion (up to 28.1.5). CVE-2026-4021, https://www.wordfence.com/threat-intel/vulnerabilities/id/f1b9725b-dee5-44ca-bb33-c6812fb76adc?source=api-prod
- 2026-03-10 MEDIUM: Authenticated (Subscriber+) Server-Side Request Forgery (up to 28.1.2.1). CVE-2026-24964, https://www.wordfence.com/threat-intel/vulnerabilities/id/16bbabe5-e8cf-43fa-ae7d-326045464192?source=api-prod
- 2026-03-02 HIGH: Unauthenticated SQL Injection (up to 28.1.4). CVE-2026-3180, https://www.wordfence.com/threat-intel/vulnerabilities/id/91d52a64-8dc1-4923-be0b-06800382151e?source=api-prod
- 2026-01-09 MEDIUM: Missing Authorization (up to 28.1.1). CVE-2026-24965, https://www.wordfence.com/threat-intel/vulnerabilities/id/7db0a94e-2633-4f62-adb6-9acb3f884cb8?source=api-prod
- 2025-11-14 MEDIUM: Missing Authorization (up to 28.0.2). CVE-2025-12849, https://www.wordfence.com/threat-intel/vulnerabilities/id/e000c4ad-43ec-4ad0-89f9-74e9e6d8b917?source=api-prod
- 2025-10-12 MEDIUM: Cross-Site Request Forgery (up to 28.0.0). CVE-2025-62950, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f854ffc-244b-45c3-94ce-198e85c11869?source=api-prod
- 2025-10-10 MEDIUM: Unauthenticated CSV Injection (up to 27.0.3). CVE-2025-11254, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a0dc62c-786d-40f3-b9c9-bd199a176192?source=api-prod
- 2025-10-03 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 27.0.2). CVE-2025-10383, https://www.wordfence.com/threat-intel/vulnerabilities/id/de379f74-660a-4e59-b1c4-4b88dff8a843?source=api-prod
- 2025-07-31 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 26.1.0). CVE-2025-7725, https://www.wordfence.com/threat-intel/vulnerabilities/id/18003103-3a14-4cbc-8bed-87a8ab050308?source=api-prod
- 2025-07-11 MEDIUM: Reflected Cross-Site Scripting (up to 26.0.6). CVE-2025-48291, https://www.wordfence.com/threat-intel/vulnerabilities/id/0f835e7c-f921-449d-9ffc-dd0fd141119d?source=api-prod
- 2025-07-10 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 26.0.8). CVE-2025-6716, https://www.wordfence.com/threat-intel/vulnerabilities/id/e54caaf5-f37b-4842-ab3d-8e37cbed58da?source=api-prod
- 2025-05-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (up to 26.0.6). CVE-2025-3862, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b043a1-7bee-4ef0-86d9-19cf202cfc71?source=api-prod
- 2025-02-27 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 26.0.0.1). CVE-2025-1513, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5cf360-0163-4a7c-8979-ec89ec80ad62?source=api-prod
- 2025-01-31 MEDIUM: Authenticated (Author+) SQL Injection (up to 25.1.0). CVE-2025-22693, https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb84512-82c3-4def-a11b-ba0b7d64c41f?source=api-prod
- 2024-12-30 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 24.0.3). CVE-2024-56237, https://www.wordfence.com/threat-intel/vulnerabilities/id/2aa5b7e8-3030-47d3-9440-3b1b5c94b5ec?source=api-prod
- 2024-11-27 CRITICAL: Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover (up to 24.0.7). CVE-2024-11103, https://www.wordfence.com/threat-intel/vulnerabilities/id/0df7f413-2631-46d9-8c0b-d66f05a02c01?source=api-prod
- 2024-11-04 CRITICAL: Unauthenticated SQL Injection (up to 24.0.3). CVE-2024-10687, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd3b4c44-d47a-45de-bcb2-0820e475b331?source=api-prod
- 2024-08-16 MEDIUM: Unauthenticated Information Exposure (up to 23.1.2). CVE-2024-43283, https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e400f8-35b4-4be4-bb00-c59e14ddd57f?source=api-prod
- 2024-07-24 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 23.1.2). CVE-2024-39631, https://www.wordfence.com/threat-intel/vulnerabilities/id/1dba61bb-2d26-483e-835f-c3841f07efe6?source=api-prod
- 2024-04-22 MEDIUM: Authenticated (Author+) Arbitrary File Deletion (up to 21.3.4). CVE-2024-32778, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed63de5-ef65-4e90-afc1-b7a075e99316?source=api-prod
- 2024-03-28 MEDIUM: Reflected Cross-Site Scripting (up to 21.3.5). CVE-2024-30428, https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0c54f2-3942-48bd-b821-b66a57fd1506?source=api-prod
- 2024-03-26 CRITICAL: Authenticated (Contributor+) SQL Injection (up to 21.3.2). CVE-2024-30238, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3150b3-fba1-4e89-8f4e-b6c605227395?source=api-prod
- 2024-03-26 CRITICAL: Authenticated (Contributor+) SQL Injection (up to 21.3.4). CVE-2024-30236, https://www.wordfence.com/threat-intel/vulnerabilities/id/79fb4f24-8a59-4e57-b583-c87ee2493cdb?source=api-prod
- 2024-02-14 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 21.3.0). CVE-2024-1487, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ef37e72-f98f-4df6-8adb-514690350a82?source=api-prod
- 2024-02-05 MEDIUM: Cross-Site Request Forgery (up to 21.2.8.4). CVE-2024-24887, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ed8c6e-5f80-4360-9478-fff49b1fee94?source=api-prod
- 2024-01-09 MEDIUM: Cross-Site Request Forgery (up to 21.2.8.4). WF-f2b5213d-fdc5-4c98-9a05-15d83bd7308f, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b5213d-fdc5-4c98-9a05-15d83bd7308f?source=api-prod
- 2023-10-10 MEDIUM: Unauthenticated Stored Cross-Site Scripting via headers (before 21.2.8.1). CVE-2023-5307, https://www.wordfence.com/threat-intel/vulnerabilities/id/3e3c9f08-9e73-4791-b6ca-2c8b9dc3fb81?source=api-prod
- 2023-03-27 MEDIUM: Reflected Cross-Site Scripting (up to 21.1.2). CVE-2023-28784, https://www.wordfence.com/threat-intel/vulnerabilities/id/7dbd3b23-cebc-4212-bcae-c6f23031c040?source=api-prod
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4150, https://wpscan.com/vulnerability/d5d39138-a216-46cd-9e5f-fc706a2c93da
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4151, https://wpscan.com/vulnerability/e1320c2a-818d-4e91-8dc9-ba95a1dc4377
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5). CVE-2022-4152, https://wpscan.com/vulnerability/4b058966-0859-42ed-a796-b6c6cb08a9fc
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4153, https://wpscan.com/vulnerability/35b0126d-9293-4e64-a00f-0903303f960a
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4155, https://wpscan.com/vulnerability/a55c6a62-3744-4374-b01a-cb074ac64b4d
- 2022-12-26 HIGH: SQL Injection (before 19.1.5.1). CVE-2022-4156, https://wpscan.com/vulnerability/254f6e8b-5fa9-4d6d-8e0e-1a4cae18aee0
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4157, https://wpscan.com/vulnerability/71feec63-67a5-482e-bf77-1396c306fae6
- 2022-12-26 HIGH: SQL Injection (before 19.1.5.1). CVE-2022-4158, https://wpscan.com/vulnerability/1b3b51af-ad73-4f8e-ba97-375b8a363b64
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4159, https://wpscan.com/vulnerability/2e993280-1007-4e9d-9ca6-2b5f774e9965
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4160, https://wpscan.com/vulnerability/813de343-4814-42b8-b8df-1695320512cd
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4161, https://wpscan.com/vulnerability/a66af8f7-1d5f-4fe5-a2ba-03337064583b
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4162, https://wpscan.com/vulnerability/011500ac-17e4-4d4f-bbd9-1fec70511776
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4163, https://wpscan.com/vulnerability/de0d7db7-f911-4f5f-97f6-885ca60822d1
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4164, https://wpscan.com/vulnerability/57fff222-2c64-4b52-86cd-ab8db4541627
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4165, https://wpscan.com/vulnerability/857aba7d-fccd-4672-b734-ab228440dcc0
- 2022-12-26 MEDIUM: SQL Injection (before 19.1.5.1). CVE-2022-4166, https://wpscan.com/vulnerability/6e7de2bb-5f71-4c27-ae79-4f6b2ba7f86f
- 2022-12-05 HIGH: Unauthenticated SQL Injection via cg_Fields (up to 19.1.4.1). WF-10e05707-02cb-42de-8399-4556d76b01b3, https://www.wordfence.com/threat-intel/vulnerabilities/id/10e05707-02cb-42de-8399-4556d76b01b3?source=api-prod
- 2022-12-05 HIGH: Unauthenticated SQL Injection via user_id (up to 19.1.5). WF-1a0fa7f6-cc1a-45fe-881d-694c81b841c7, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a0fa7f6-cc1a-45fe-881d-694c81b841c7?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_option_id (up to 19.1.4.1). WF-213fde1b-13dc-442a-8f48-4b1074155a6f, https://www.wordfence.com/threat-intel/vulnerabilities/id/213fde1b-13dc-442a-8f48-4b1074155a6f?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via wp_user_id (up to 19.1.4.1). WF-250788a8-55d1-416b-bf1c-2170e8483ccc, https://www.wordfence.com/threat-intel/vulnerabilities/id/250788a8-55d1-416b-bf1c-2170e8483ccc?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_multiple_files_for_post (up to 19.1.4.1). WF-3b1b1a55-7872-456f-a754-023aad354359, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b1b1a55-7872-456f-a754-023aad354359?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_copy_id (up to 19.1.4.1). WF-3e9672b1-6d00-45bc-91ef-0c5583b5306e, https://www.wordfence.com/threat-intel/vulnerabilities/id/3e9672b1-6d00-45bc-91ef-0c5583b5306e?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_copy_start (up to 19.1.4.1). WF-407d8ebe-f3fc-433a-856f-de2ad4e58b9e, https://www.wordfence.com/threat-intel/vulnerabilities/id/407d8ebe-f3fc-433a-856f-de2ad4e58b9e?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via option_id GET (up to 19.1.4.1). WF-691eb4c1-18ba-433b-8725-70f2ecf89b0a, https://www.wordfence.com/threat-intel/vulnerabilities/id/691eb4c1-18ba-433b-8725-70f2ecf89b0a?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_order (up to 19.1.4.1). WF-6f946251-c7be-4ef6-885f-8b378c0c234c, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f946251-c7be-4ef6-885f-8b378c0c234c?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_row (up to 19.1.4.1). WF-75c6697c-bc1d-456f-baee-ee9c57e40d21, https://www.wordfence.com/threat-intel/vulnerabilities/id/75c6697c-bc1d-456f-baee-ee9c57e40d21?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via cg_id (up to 19.1.5). WF-b24625d7-2a38-451b-ab79-a1d9c5b8822a, https://www.wordfence.com/threat-intel/vulnerabilities/id/b24625d7-2a38-451b-ab79-a1d9c5b8822a?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via upload[] (up to 19.1.5). WF-cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8, https://www.wordfence.com/threat-intel/vulnerabilities/id/cf24ee30-7d9f-47c3-bc2a-1c3c92971ba8?source=api-prod
- 2022-12-05 HIGH: SQL Injection via option_id (up to 19.1.5). WF-e7fcda2b-d679-44af-9592-4a96a0115a08, https://www.wordfence.com/threat-intel/vulnerabilities/id/e7fcda2b-d679-44af-9592-4a96a0115a08?source=api-prod
- 2022-12-05 HIGH: Authenticated (Author+) SQL Injection via addCountS (up to 19.1.4.1). WF-f185709e-0d13-48d3-9c15-03466b72dac2, https://www.wordfence.com/threat-intel/vulnerabilities/id/f185709e-0d13-48d3-9c15-03466b72dac2?source=api-prod
- 2022-11-29 HIGH: Authenticated (Author+) SQL Injection via option_id (up to 19.1.4.1). WF-31196bdf-2ddd-49ea-840d-8fd78611629e, https://www.wordfence.com/threat-intel/vulnerabilities/id/31196bdf-2ddd-49ea-840d-8fd78611629e?source=api-prod
- 2022-11-29 HIGH: Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate (up to 19.1.4.1). WF-5d080f5b-6646-47ef-8ae7-8b94270f9f59, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d080f5b-6646-47ef-8ae7-8b94270f9f59?source=api-prod
- 2022-11-23 MEDIUM: Cross-Site Scripting (up to 13.1.0.9). CVE-2022-45848, https://www.wordfence.com/threat-intel/vulnerabilities/id/f36af71c-78af-402c-9d3a-3752368e7584?source=api-prod
- 2022-08-09 HIGH: Authenticated (Author+) SQL Injection (up to 17.0.4). CVE-2022-36394, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9b90e03-cdaa-4bd3-9afd-5d5c91a17962?source=api-prod
- 2022-06-01 HIGH: Admin+ SQL Injection (up to 17.0.4). WF-1f9d8bbe-205f-44b6-a0c6-89b9135e6363, https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9d8bbe-205f-44b6-a0c6-89b9135e6363?source=api-prod
- 2022-04-13 CRITICAL: SQL Injection (up to 13.1.0.5). CVE-2021-24915, https://www.wordfence.com/threat-intel/vulnerabilities/id/3184c304-52d3-4baa-b3c2-90957e1d8e79?source=api-prod
- 2021-12-20 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 13.1.0.9). CVE-2022-27853, https://www.wordfence.com/threat-intel/vulnerabilities/id/78f745f9-c44e-4458-9381-f639c842a31e?source=api-prod
- 2021-11-01 MEDIUM: Authenticated Email Address Disclosure (before 13.1.0.7). WF-7759b209-4211-4ee5-ae7a-42645f5d5e96, https://www.wordfence.com/threat-intel/vulnerabilities/id/7759b209-4211-4ee5-ae7a-42645f5d5e96?source=api-prod
- 2019-06-12 HIGH: Cross-Site Request Forgery (up to 10.4.4). CVE-2019-5974, https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b6d33-82cd-4c41-ba54-dbc7fe5f6ac6?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=contest-gallery · HTML: https://todaywp.com/plugins/contest-gallery