Wpchill
59 CVEs across 42 Wpchill products. Browse Wpchill vulnerabilities, severities, and proof-of-concept exploits.
Wpchill products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16144 | High | 8.1 | 2026-08-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20… |
CVE-2026-15395 | High | 7.2 | 2026-07-17 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in a… |
CVE-2026-9107 | Medium | 6.4 | 2026-07-01 | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_component… |
CVE-2026-3239 | Medium | 6.4 | 2026-04-08 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, an… |
CVE-2026-4401 | Medium | 5.4 | 2026-04-08 | The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the `actions_handler()` and `bulk_actions_handler()` methods in `class… |
CVE-2026-3124 | High | 7.5 | 2026-03-30 | The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment(… |
CVE-2026-3584 | Critical | 9.8 | 2026-03-20 | The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is… |
CVE-2026-1860 | Medium | 4.3 | 2026-02-18 | The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_item… |
CVE-2026-1254 | Medium | 4.3 | 2026-02-14 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6… |
CVE-2025-14865 | Medium | 6.4 | 2026-01-28 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortc… |
CVE-2025-15466 | Medium | 5.4 | 2026-01-20 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on… |
CVE-2025-14632 | Medium | 4.4 | 2026-01-17 | The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and in… |
CVE-2025-14426 | Medium | 4.3 | 2025-12-30 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function… |
CVE-2025-13693 | Medium | 6.4 | 2025-12-21 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up… |
CVE-2025-14455 | Medium | 5.4 | 2025-12-19 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to… |
CVE-2025-14003 | Medium | 4.3 | 2025-12-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-13891 | Medium | 6.5 | 2025-12-12 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due t… |
CVE-2025-13646 | High | 7.5 | 2025-12-03 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in… |
CVE-2025-13645 | High | 7.2 | 2025-12-03 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' functi… |
CVE-2025-12494 | Medium | 4.3 | 2025-11-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the aj… |
CVE-2025-11268 | Medium | 4.3 | 2025-11-06 | The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the so… |
CVE-2025-10000 | Medium | 6.4 | 2025-09-30 | The Qyrr – simply and modern QR-Code creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_f… |
CVE-2025-7367 | Medium | 6.4 | 2025-07-15 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and includin… |
CVE-2024-9416 | Medium | 6.4 | 2025-04-03 | The Modula Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions <= 5… |
CVE-2024-6261 | Medium | 6.4 | 2025-02-27 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'FinalTilesGallery' shortcode in al… |
CVE-2024-12853 | High | 8.8 | 2025-01-08 | The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in al… |
CVE-2024-12711 | Medium | 5.3 | 2025-01-07 | The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_d… |
CVE-2024-11282 | Medium | 5.3 | 2025-01-07 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-11106 | Medium | 5.3 | 2024-12-10 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.7 via the WordPress core sea… |
CVE-2024-49256 | Medium | 5.4 | 2024-11-01 | Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2024-47362 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16. |
CVE-2024-10399 | Medium | 4.3 | 2024-10-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users functio… |
CVE-2024-10092 | Medium | 4.3 | 2024-10-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actio… |
CVE-2022-4974 | Medium | 6.3 | 2024-10-16 | The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to… |
CVE-2022-4972 | High | 7.5 | 2024-10-16 | The Download Monitor plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST-API routes related to reporti… |
CVE-2024-8552 | Medium | 4.3 | 2024-09-26 | The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enable_shop() function in… |
CVE-2024-6571 | Medium | 5.3 | 2024-07-24 | The Optimize Images ALT Text (alt tag) & names for SEO using AI plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including… |
CVE-2024-3710 | Medium | 6.8 | 2024-07-13 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them bac… |
CVE-2023-6491 | Medium | 4.3 | 2024-06-07 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sti… |
CVE-2024-3269 | Medium | 5.4 | 2024-05-30 | The Download Monitor plugin for WordPress is vulnerable to unauthorized access to functionality due to a missing capability check on the dlm_uninstall_plugin f… |
CVE-2024-3261 | Medium | 4.8 | 2024-04-24 | The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post… |
CVE-2024-32429 | Medium | 5.9 | 2024-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPChill Remove Footer Credit allows Stored XSS.This issue… |
CVE-2024-2026 | Medium | 6.4 | 2024-04-09 | The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and includin… |
CVE-2024-30501 | High | 7.6 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Moni… |
CVE-2024-1083 | Medium | 5.3 | 2024-03-13 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This mak… |
CVE-2024-1218 | Medium | 4.3 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized access and modification of data via API… |
CVE-2024-1217 | High | 7.6 | 2024-02-29 | The Contact Form builder with drag & drop for WordPress – Kali Forms plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing ca… |
CVE-2024-0616 | Medium | 5.3 | 2024-02-29 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2022-45354 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7… |
CVE-2023-52123 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10. |
CVE-2023-34007 | Critical | 9.9 | 2023-12-20 | Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3. |
CVE-2023-5704 | Medium | 6.4 | 2023-11-22 | The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 du… |
CVE-2023-31219 | Medium | 4.1 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1. |
CVE-2023-28171 | Medium | 5.4 | 2023-06-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <= 1.3.1 versions. |
CVE-2023-26013 | Medium | 6.5 | 2023-06-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill Strong Testimonials plugin <= 3.0.2 versions. |
CVE-2020-36721 | Medium | 6.5 | 2023-06-07 | The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the… |
CVE-2020-36720 | High | 7.1 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lac… |
CVE-2020-36717 | High | 8.8 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handlin… |
CVE-2020-36712 | High | 8.6 | 2023-06-07 | The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kalifo… |
CVE-2020-36708 | Critical | 9.8 | 2023-06-07 | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0… |
CVE-2023-25451 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPChill CPO Content Types plugin <= 1.1.0 versions. |
CVE-2022-4544 | Medium | 5.4 | 2023-01-16 | The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2023-0162 | Medium | 5.5 | 2023-01-10 | The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and… |
CVE-2022-41135 | Medium | 6.5 | 2022-11-18 | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. |
CVE-2022-2981 | Medium | 4.9 | 2022-10-10 | The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high p… |
CVE-2022-40672 | Medium | 4.8 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress. |
CVE-2022-37407 | Medium | 4.1 | 2022-09-09 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-36292 | Medium | 5.4 | 2022-08-23 | Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. |
CVE-2022-2222 | Medium | 4.9 | 2022-07-17 | The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high p… |
CVE-2022-1547 | Medium | 6.1 | 2022-05-23 | The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leadin… |
CVE-2022-1054 | Medium | 5.3 | 2022-04-18 | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export functi… |
CVE-2022-27852 | Medium | 6.1 | 2022-04-15 | Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions. |
CVE-2021-25050 | Medium | 4.8 | 2022-02-14 | The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting atta… |
CVE-2021-24446 | Medium | 5.4 | 2022-02-14 | The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in… |
CVE-2021-31567 | Medium | 6.8 | 2022-01-28 | Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary f… |
CVE-2021-23174 | Low | 3.4 | 2022-01-28 | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable param… |
CVE-2021-36920 | Medium | 4.8 | 2022-01-14 | Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6). |
CVE-2021-24786 | High | 7.2 | 2022-01-03 | The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when vi… |
CVE-2021-24908 | Medium | 6.1 | 2021-11-29 | The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Sit… |
CVE-2021-24774 | High | 7.2 | 2021-10-25 | The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement… |
CVE-2020-9003 | Medium | 5.4 | 2020-02-20 | A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an a… |
CVE-2020-8549 | Medium | 6.1 | 2020-02-03 | Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens. |