Unknown Contest Gallery vulnerabilities

4 CVEs affecting Unknown Contest Gallery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-107120, published 2026-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16055, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, issuing an authentication cookie directly after the password…
CVE-2026-16057, published 2026-08-03. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which…
CVE-2026-16056, published 2026-08-04. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down to Subscriber to read the site's entire…
CVE-2026-107120, published 2026-10-10. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing…