6.5
Moyenne
CVE-2022-4164 The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape…
Description
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Contest Gallery 19.1 | premières → < 19.1.5.1 | 19.1.5.1 |
| Contest Gallery Pro 19.1 | premières → < 19.1.5.1 | 19.1.5.1 |
Références
- wpscan.com wpscan.com
- bulletin.iese.de bulletin.iese.de
Chronologie
- Publiée
- Dernière modification
Autres CVE de Contest Gallery
Les 21 CVE de Contest Gallery →
CVE-2026-107447
The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its…
5.3
Moyenne
CVE-2026-107120
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end…
5.3
Moyenne
CVE-2026-16055
The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress…
7.5
Élevée
CVE-2026-16056
The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its…
4.3
Moyenne