CVE-2026-16586

Name of the Vulnerable Software and Affected Versions The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress versions prior to 30.0.8

Description An issue exists where authenticated attackers with author-level access and above can perform a Second-Order SQL Injection. This occurs via the cg multiple files for post parameter and the cgRealId variable due to insufficient escaping of user-supplied data and lack of proper preparation of the SQL query. This allows attackers to append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 30.0.7.