Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe vulnerabilities
Plugin slug contest-gallery · 70 known vulnerabilities · latest disclosed 2026-11-11 · WordPress.org page
Every listed vulnerability has a fix. Version 34.0.3 or later is not affected by any of them. If your site runs an older version, update it.
35 of 70 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| High 8.8 | < 34.0.3 | 34.0.3 | CVE-2026-118041 | 2026-11-11 | Advisory |
| Medium 5.3 | < 34.0.1 | 34.0.1 | CVE-2026-107447 | 2026-10-21 | Advisory |
| Medium 6.4 | <= 34.0.1 | 34.0.2 | CVE-2026-111837 | 2026-10-19 | Advisory |
| Medium 5.3 | <= 33.0.0 | 33.0.1 | CVE-2026-107120 | 2026-10-08 | Advisory |
| High 8.8 | <= 32.0.1 | 33.0.0 | CVE-2026-78088 | 2026-09-15 | Advisory |
| High 7.2 | <= 30.0.5 | 30.0.6 | CVE-2026-61986 | 2026-08-19 | Advisory |
| Medium 6.5 | <= 30.0.7 | 31.0.0 | CVE-2026-16586 | 2026-08-14 | Advisory |
| Medium 5.3 | <= 30.0.6 | 30.0.7 | CVE-2026-16055 | 2026-07-29 | Advisory |
| High 7.2 | <= 30.0.6 | 30.0.7 | CVE-2026-65447 | 2026-07-27 | Advisory |
| Medium 4.3 | <= 30.0.6 | 30.0.7 | CVE-2026-16056 | 2026-07-27 | Advisory |
| Medium 4.3 | <= 30.0.6 | 30.0.7 | CVE-2026-16057 | 2026-07-23 | Advisory |
| Medium 6.5 | <= 30.0.0 | 30.0.1 | CVE-2026-57662 | 2026-06-26 | Advisory |
| High 8.8 | <= 30.0.2 | 30.0.3 | CVE-2026-12165 | 2026-06-16 | Advisory |
| High 7.5 | <= 28.1.6 | 28.1.7 | CVE-2026-8912 | 2026-05-18 | Advisory |
| Medium 5.3 | <= 28.1.7 | 29.0.0 | CVE-2026-42657 | 2026-04-29 | Advisory |
| Medium 6.4 | <= 28.1.6 | 29.0.0 | CVE-2026-42656 | 2026-04-29 | Advisory |
| Medium 4.3 | <= 28.1.7 | 29.0.0 | CVE-2026-42660 | 2026-04-29 | Advisory |
| High 7.5 | <= 28.1.6 | 28.1.7 | CVE-2026-40771 | 2026-04-21 | Advisory |
| High 8.1 | <= 28.1.5 | 28.1.6 | CVE-2026-4021 | 2026-03-23 | Advisory |
| Medium 5.3 | <= 28.1.2.2 | 28.1.3 | CVE-2026-25035 | 2026-03-23 | Advisory |
| Medium 6.4 | <= 28.1.2.1 | 28.1.2.2 | CVE-2026-24964 | 2026-03-10 | Advisory |
| High 7.5 | <= 28.1.4 | 28.1.5 | CVE-2026-3180 | 2026-03-02 | Advisory |
| Medium 4.3 | <= 28.1.1 | 28.1.2 | CVE-2026-24965 | 2026-01-09 | Advisory |
| Medium 5.3 | <= 28.0.2 | 28.0.3 | CVE-2025-12849 | 2025-11-14 | Advisory |
| Medium 4.3 | <= 28.0.0 | 28.0.1 | CVE-2025-62950 | 2025-10-12 | Advisory |
| Medium 4.3 | <= 27.0.3 | 28.0.0 | CVE-2025-11254 | 2025-10-10 | Advisory |
| Medium 6.4 | <= 27.0.2 | 27.0.3 | CVE-2025-10383 | 2025-10-03 | Advisory |
| High 7.2 | <= 26.1.0 | 26.1.1 | CVE-2025-7725 | 2025-07-31 | Advisory |
| Medium 6.1 | <= 26.0.6 | 26.0.7 | CVE-2025-48291 | 2025-07-11 | Advisory |
| Medium 6.4 | <= 26.0.8 | 26.0.9 | CVE-2025-6716 | 2025-07-10 | Advisory |
| Medium 6.4 | <= 26.0.6 | 26.0.7 | CVE-2025-3862 | 2025-05-07 | Advisory |
| High 7.2 | <= 26.0.0.1 | 26.0.1 | CVE-2025-1513 | 2025-02-27 | Advisory |
| Medium 6.5 | <= 25.1.0 | 25.1.2 | CVE-2025-22693 | 2025-01-31 | Advisory |
| Medium 6.4 | <= 24.0.3 | 24.0.4 | CVE-2024-56237 | 2024-12-30 | Advisory |
| Critical 9.8 | <= 24.0.7 | 24.0.8 | CVE-2024-11103 | 2024-11-27 | Advisory |
| Critical 9.8 | <= 24.0.3 | 24.0.4 | CVE-2024-10687 | 2024-11-04 | Advisory |
| Medium 5.3 | <= 23.1.2 | 23.1.3 | CVE-2024-43283 | 2024-08-16 | Advisory |
| Medium 6.1 | <= 23.1.2 | 23.1.3 | CVE-2024-39631 | 2024-07-24 | Advisory |
| Medium 4.3 | <= 21.3.4 | 21.3.5 | CVE-2024-32778 | 2024-04-22 | Advisory |
| Medium 6.1 | <= 21.3.5 | 21.3.6 | CVE-2024-30428 | 2024-03-28 | Advisory |
| Critical 9.9 | <= 21.3.2 | 21.3.2.1 | CVE-2024-30238 | 2024-03-26 | Advisory |
| Critical 9.9 | <= 21.3.4 | 21.3.5 | CVE-2024-30236 | 2024-03-26 | Advisory |
| Medium 6.4 | <= 21.3.0 | 21.3.1 | CVE-2024-1487 | 2024-02-14 | Advisory |
| Medium 4.3 | <= 21.2.8.4 | 21.2.9 | CVE-2024-24887 | 2024-02-05 | Advisory |
| Medium 4.7 | <= 21.2.8.4 | 21.2.9 | none | 2024-01-09 | Advisory |
| Medium 6.1 | < 21.2.8.1 | 21.2.8.1 | CVE-2023-5307 | 2023-10-10 | Advisory |
| Medium 6.1 | <= 21.1.2 | 21.1.2.1 | CVE-2023-28784 | 2023-03-27 | Advisory |
| High 8.1 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4158 | 2022-12-05 | Advisory |
| High 8.1 | <= 19.1.5 | 19.1.5.1 | CVE-2022-4156 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4157 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4155 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4164 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4160 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4161 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4152 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4165 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4162 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.5 | 19.1.5.1 | CVE-2022-4159 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.5 | 19.1.5.1 | CVE-2022-4153 | 2022-12-05 | Advisory |
| High 8.8 | <= 19.1.5 | 19.1.5.1 | CVE-2022-4150 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4166 | 2022-12-05 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4151 | 2022-11-29 | Advisory |
| High 7.5 | <= 19.1.4.1 | 19.1.5 | CVE-2022-4163 | 2022-11-29 | Advisory |
| Medium 6.1 | <= 13.1.0.9 | 14.0.0 | CVE-2022-45848 | 2022-11-23 | Advisory |
| High 8.8 | <= 17.0.4 | 17.0.5 | CVE-2022-36394 | 2022-08-09 | Advisory |
| High 7.2 | <= 17.0.4 | 17.0.5 | none | 2022-06-01 | Advisory |
| Critical 9.8 | <= 13.1.0.5 | 13.1.0.6 | CVE-2021-24915 | 2022-04-13 | Advisory |
| Medium 6.4 | <= 13.1.0.9 | 14.0.0 | CVE-2022-27853 | 2021-12-20 | Advisory |
| Medium 4.3 | < 13.1.0.7 | 13.1.0.7 | none | 2021-11-01 | Advisory |
| High 8.8 | <= 10.4.4 | 10.4.5 | CVE-2019-5974 | 2019-06-12 | Advisory |
Check if a site is affected
Enter a site address to see which version of Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe plugin safe to use?
All 70 known issues are fixed in current versions (34.0.3 or later). Keeping it updated is what matters.
How do I check which version of Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome