Wpchill vulnerabilities

Products

• Strong Testimonials 21
• Kali Forms — Contact Form & Drag-and-drop Builder 16
• Download Monitor 13
• Download Monitor 12
• Modula Image Gallery – Photo Grid & Video Gallery 9
• Image Photo Gallery Final Tiles Grid 6
• Strong Testimonials 6
• Modula Image Gallery 5
• Passster – Password Protect Pages And Content 5
• Brilliance 3
• Check \& Log Email 3
• Filr – Secure Document Library 3
• Passster 3
• Remove Footer Credit 3
• Remove Footer Credit 3
• Simple Restrict 3
• Cpo Shortcodes 2
• Gallery Photoblocks 2
• Gallery Photoblocks (wordpress Plugin) 2
• Htaccess File Editor 2
• Image Gallery – Photo Grid & Video Gallery 2
• Qyrr – Simply And Modern Qr-code Creation 2
• Simple Restrict 2

Newest

• wpchill modula image gallery – photo grid & video gallery Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter CVE-2026-121976 6.4 MediumNovember 7, 2026
• wpchill strong testimonials Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter CVE-2026-115811 7.2 HighNovember 7, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action CVE-2026-106649 6.8 MediumNovember 4, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing CVE-2026-107343 4.3 MediumNovember 1, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure CVE-2026-107342 4.3 MediumNovember 1, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability CVE-2026-114706 6.5 MediumOctober 29, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability CVE-2026-112843 4.3 MediumOctober 22, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability CVE-2026-107435 7.1 HighOctober 21, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability CVE-2026-107436 8.8 HighOctober 18, 2026
• wpchill modula image gallery – photo grid & video gallery Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT CVE-2026-107659 7.5 HighOctober 16, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability CVE-2026-109897 5.4 MediumOctober 15, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability CVE-2026-110371 4.3 MediumOctober 15, 2026
• wpchill strong testimonials Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field CVE-2026-96650 7.2 HighOctober 3, 2026
• wp chill download monitor Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor CVE-2026-100182 7.2 HighOctober 2, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability CVE-2026-97286 Public exploit 6.5 MediumSeptember 30, 2026
• wpchill modula image gallery – photo grid & video gallery Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters CVE-2026-89406 7.5 HighSeptember 25, 2026
• wpchill modula image gallery – photo grid & video gallery Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter CVE-2026-92713 8.1 HighSeptember 25, 2026
• wpchill strong testimonials Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute CVE-2026-92622 6.4 MediumSeptember 18, 2026
• wp chill image photo gallery final tiles grid Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute CVE-2026-4559 6.4 MediumAugust 22, 2026
• unknown simple restrict Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API CVE-2026-15939 2.7 LowAugust 2, 2026
• wpchill kali forms — contact form & drag-and-drop builder Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVE-2026-16144 8.1 HighAugust 1, 2026
• wpchill kali forms — contact form & drag-and-drop builder Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value CVE-2026-15395 7.2 HighJuly 17, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR CVE-2026-11580 5.5 MediumJuly 15, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.17 - Unauthenticated Media Upload CVE-2026-11579 5.3 MediumJuly 15, 2026
• wpchill kali forms — contact form & drag-and-drop builder Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter CVE-2026-9107 6.4 MediumJuly 1, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption CVE-2026-11581 5.9 MediumJune 30, 2026
• wpchill strong testimonials Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode CVE-2026-3239 6.4 MediumApril 8, 2026
• wp chill download monitor Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling CVE-2026-4401 5.4 MediumApril 7, 2026
• wp chill download monitor Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' CVE-2026-3124 7.5 HighMarch 30, 2026
• wpchill kali forms — contact form & drag-and-drop builder Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process CVE-2026-3584 Public exploit 9.8 CriticalMarch 20, 2026
• wpchill kali forms — contact form & drag-and-drop builder Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure CVE-2026-1860 4.3 MediumFebruary 18, 2026
• wpchill modula image gallery – photo grid & video gallery Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing CVE-2026-1254 4.3 MediumFebruary 14, 2026
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability CVE-2026-24957 6.5 MediumFebruary 3, 2026
• wpchill passster – password protect pages and content Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-14865 6.4 MediumJanuary 28, 2026
• wp chill image photo gallery final tiles grid Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management CVE-2025-15466 5.4 MediumJanuary 19, 2026
• wpchill filr – secure document library Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload CVE-2025-14632 4.4 MediumJanuary 17, 2026
• wpchill strong testimonials Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update CVE-2025-14426 4.3 MediumDecember 30, 2025
• wp chill image photo gallery final tiles grid Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting CVE-2025-13693 6.4 MediumDecember 21, 2025
• wp chill image photo gallery final tiles grid Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management CVE-2025-14455 5.4 MediumDecember 19, 2025
• wpchill modula image gallery – photo grid & video gallery Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification CVE-2025-14003 4.3 MediumDecember 15, 2025
• wpchill modula image gallery – photo grid & video gallery Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing CVE-2025-13891 6.5 MediumDecember 12, 2025
• wpchill modula image gallery, image gallery – photo grid & video gallery +1 more Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition CVE-2025-13646 7.5 HighDecember 3, 2025
• wpchill modula image gallery, image gallery – photo grid & video gallery +1 more Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion CVE-2025-13645 7.2 HighDecember 3, 2025
• wpchill modula image gallery – photo grid & video gallery Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move CVE-2025-12494 4.3 MediumNovember 15, 2025
• wpchill strong testimonials Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-11268 4.3 MediumNovember 6, 2025
• patrickposner qyrr – simply and modern qr-code creation Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload CVE-2025-10000 6.4 MediumSeptember 30, 2025
• wpchill strong testimonials Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields CVE-2025-7367 6.4 MediumJuly 15, 2025
• wpchill modula image gallery, modula image gallery – photo grid & video gallery +1 more Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library CVE-2024-9416 6.4 MediumApril 3, 2025
• machothemes image photo gallery final tiles grid Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVE-2024-6261 6.4 MediumFebruary 27, 2025
• wp chill strong testimonials WordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerability CVE-2025-26975 5.3 MediumFebruary 25, 2025
• Show olderLoading…