CVE-2026-61986

There is an unauthenticated SQL Injection vulnerability in Contest Gallery versions up to 28.1.6.

The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.

The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password check, which bypasses installed brute-force-protection and two-factor-authentication. This enables unlimited, unthrottled password guessing against any account (including administrators) up to full account takeover.

The Contest Gallery WordPress plugin before version 30.0.7 fails to perform capability or nonce checks in one of its post-deletion handlers, relying only on a coarse role-membership test. This allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other content they do not own.

A Cross Site Scripting (XSS) vulnerability in the Contest Gallery plugin for WordPress versions up to 30.0.6. An unauthenticated attacker can inject a malicious script.

Contest Gallery versions up to 28.1.7 have a vulnerability that allows for the exposure of subscriber sensitive data.

Contest Gallery versions up to 28.1.7 contain an unauthenticated vulnerability that may be exploited by attackers.

There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in Contest Gallery versions up to 28.1.6.

The Contest Gallery plugin by ContestGallery developer contains a Cross-Site Request Forgery vulnerability in versions from n/a through 28.0.0. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.