{"cvss":0.0,"datePublished":"2026-03-10T00:00:00Z","dateUpdated":"2026-03-10T00:00:00Z","description":"The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address","dueDate":"","id":"CVE-2021-24915","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"contest_gallery","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"contest_gallery contest_gallery Improper Neutralization of Special Elements used in an SQL Command","vendor":"contest_gallery"}