Cross-site request forgery in Wasiliy Strecker / ContestGallery developer Contest Gallery
Priority MEDIUM 40CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in Contest Gallery versions prior to 10.4.5 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Why it matters now
EPSS 0.01036 64th percentileScored 2026-11-07
Fix Fixed Contest Gallery (Contest-Gallery): 10.4.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wasiliy Strecker / ContestGallery developer | Contest Gallery | before 10.4.5 | 10.4.5 | Patch available | CNA |
- Contest Gallery VendorWasiliy Strecker / ContestGallery developer Affected before 10.4.5 Fixed in 10.4.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:* | before 10.4.5 | Vulnerable | Wasiliy Strecker / ContestGallery developer |
- cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:* Versions before 10.4.5 Vulnerable ·Wasiliy Strecker / ContestGallery developer
Remediation
- Fix · CNA Contest Gallery (Contest-Gallery) Fixed in 10.4.5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5974
- 2026-10-03 Alias added: GHSA-hfjc-7hm9-35pp
References
More Wasiliy Strecker / ContestGallery developer Contest Gallery vulnerabilities
- TI-2022-03804 Contest Gallery < 19.1.5 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
- TI-2022-03802 Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
- TI-2024-26556 WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2022-03797 Contest Gallery < 19.1.5 - Admin+ SQL Injection CVSS 3.1MEDIUM 6.5
- TI-2022-03812 Contest Gallery < 19.1.5 - Author+ SQL Injection CVSS 3.1MEDIUM 6.5
- TI-2022-03811 Contest Gallery < 19.1.5 - Author+ SQL Injection CVSS 3.1MEDIUM 6.5
Sources
- CVE-2019-5974 · CVE Program
- CVE-2019-5974 · NVD
- FIRST EPSS
- GHSA-hfjc-7hm9-35pp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences