Contest Gallery Pro

Contest Gallery Pro has 18 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 18 are fixed as of September 2026. Their average CVSS score is 7.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 16 high. 2022 was the busiest year with 17 disclosures.

The most common weakness is SQL Injection, behind 16 of the records (89%). Other recurring categories include Cross-Site Scripting, Incorrect Privilege Assignment.

Every one of the 18 issues recorded for Contest Gallery Pro has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, most of them (17) reported by Kunal Sharma.

Strategic Overview

Avg CVSSHigh

7.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Contest Gallery Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-42680

Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

18 records


2026-05-17 00:00	Contest Gallery Pro <= 29.0.1 - Unauthenticated Privilege Escalation Contest Gallery Pro <= 29.0.1	`CVE-2026-42680`	9.8 Critical	daroo	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.5 - Unauthenticated SQL Injection via user_id Contest Gallery Pro <= 19.1.5	`CVE-2022-4156`	8.1 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via addCountS Contest Gallery Pro <= 19.1.4.1	`CVE-2022-4166`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery (Pro) <= 19.1.5 - SQL Injection via option_id Contest Gallery Pro <= 19.1.5	`CVE-2022-4150`	8.8 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via upload[] Contest Gallery Pro <= 19.1.5	`CVE-2022-4153`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.5 - Authenticated (Author+) SQL Injection via cg_id Contest Gallery Pro <= 19.1.5	`CVE-2022-4159`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_row Contest Gallery Pro <= 19.1.4.1	`CVE-2022-4162`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via cg_order Contest Gallery Pro <= 19.1.4.1	`CVE-2022-4165`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery <= 19.1.4.1 - Authenticated (Author+) SQL Injection via option_id GET Contest Gallery Pro <= 19.1.4.1	`CVE-2022-4152`	7.5 High	Kunal Sharma	Yes
2022-12-05 00:00	Contest Gallery Pro <= 19.1.4.1 - Authenticated (Administrator+) SQL Injection via wp_user_id Contest Gallery Pro <= 19.1.4.1	`CVE-2022-4154`	6.6 Medium	Kunal Sharma	Yes

Showing 1–10 of 18 reports