CVE-2022-4159

PoC ×2—

CVSS 3.1

6.5 medium

EPSS

<1%p56

Published

Dec 26, 2022 (Dec 26, 2022)

Modified

Jun 17, 2026

Description

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.

Vendors: contest-gallery
Products: contest gallery
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.