# cve.now: WP Chill

The newest entries naming WP Chill as an affected vendor (up to 200), of 55 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121570](https://cve.now/CVE-2026-121570.md): WordPress RSVP and Event Management plugin \<= 2.7.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-114706](https://cve.now/CVE-2026-114706.md): WordPress Strong Testimonials plugin \<= 3.3.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116408](https://cve.now/CVE-2026-116408.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-114710](https://cve.now/CVE-2026-114710.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-112843](https://cve.now/CVE-2026-112843.md): WordPress Strong Testimonials plugin \<= 3.3.14 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-107435](https://cve.now/CVE-2026-107435.md): WordPress Strong Testimonials plugin \<= 3.3.12 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-107436](https://cve.now/CVE-2026-107436.md): WordPress Strong Testimonials plugin \<= 3.3.12 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-110896](https://cve.now/CVE-2026-110896.md): WordPress Passster plugin \<= 4.3.18 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-110375](https://cve.now/CVE-2026-110375.md): WordPress Download Monitor plugin \<= 5.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-109897](https://cve.now/CVE-2026-109897.md): WordPress Strong Testimonials plugin \<= 3.3.12 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-110371](https://cve.now/CVE-2026-110371.md): WordPress Strong Testimonials plugin \<= 3.3.12 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-109896](https://cve.now/CVE-2026-109896.md): WordPress Download Monitor integration for WooCommerce plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-105876](https://cve.now/CVE-2026-105876.md): WordPress Modula Image Gallery plugin \<= 3.0.11 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-104409](https://cve.now/CVE-2026-104409.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-97286](https://cve.now/CVE-2026-97286.md): WordPress Strong Testimonials plugin \<= 3.3.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-62114](https://cve.now/CVE-2026-62114.md): WordPress Passster plugin \<= 4.3.13 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-84781](https://cve.now/CVE-2026-84781.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-81276](https://cve.now/CVE-2026-81276.md): WordPress Kali Forms plugin \<= 2.4.23 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-65446](https://cve.now/CVE-2026-65446.md): WordPress Kali Forms plugin \<= 2.4.18 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66448](https://cve.now/CVE-2026-66448.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-65475](https://cve.now/CVE-2026-65475.md): WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-59542](https://cve.now/CVE-2026-59542.md): WordPress Kali Forms plugin \<= 2.4.18 - Arbitrary File Deletion vulnerability (CVSS 7.7)
- [CVE-2026-42688](https://cve.now/CVE-2026-42688.md): WordPress Modula Image Gallery plugin \<= 2.14.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-39489](https://cve.now/CVE-2026-39489.md): WordPress Download Monitor plugin \<= 5.1.9 - Non-Arbitrary File Download vulnerability (CVSS 4.4)
- [CVE-2026-39481](https://cve.now/CVE-2026-39481.md): WordPress Modula Image Gallery plugin \<= 2.14.18 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-27398](https://cve.now/CVE-2026-27398.md): WordPress RSVP and Event Management plugin \<= 2.7.16 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-27424](https://cve.now/CVE-2026-27424.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.11 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-39561](https://cve.now/CVE-2026-39561.md): WordPress Revive.so plugin \<= 2.0.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-39536](https://cve.now/CVE-2026-39536.md): WordPress RSVP and Event Management plugin \<= 2.7.16 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-39510](https://cve.now/CVE-2026-39510.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability (CVSS 2.7)
- [CVE-2026-39486](https://cve.now/CVE-2026-39486.md): WordPress Download Monitor plugin \<= 5.1.8 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-28133](https://cve.now/CVE-2026-28133.md): WordPress Filr plugin \<= 1.2.14 - Arbitrary File Upload vulnerability (CVSS 8.5)
- [CVE-2026-25375](https://cve.now/CVE-2026-25375.md): WordPress Image Photo Gallery Final Tiles Grid plugin \<= 3.6.10 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-25036](https://cve.now/CVE-2026-25036.md): WordPress Passster plugin \<= 4.2.25 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-24957](https://cve.now/CVE-2026-24957.md): WordPress Strong Testimonials plugin \<= 3.2.20 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-24939](https://cve.now/CVE-2026-24939.md): WordPress Modula Image Gallery plugin \<= 2.13.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-24389](https://cve.now/CVE-2026-24389.md): WordPress Gallery PhotoBlocks plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-23976](https://cve.now/CVE-2026-23976.md): WordPress Modula Image Gallery plugin \<= 2.13.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-64230](https://cve.now/CVE-2025-64230.md): WordPress Filr plugin \<= 1.2.10 - Arbitrary File Deletion vulnerability (CVSS 7.7)
- [CVE-2025-64218](https://cve.now/CVE-2025-64218.md): WordPress Passster plugin \<= 4.2.19 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2025-59551](https://cve.now/CVE-2025-59551.md): WordPress Revive.so Plugin \<= 2.0.6 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-57926](https://cve.now/CVE-2025-57926.md): WordPress Passster Plugin \<= 4.2.18 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-58610](https://cve.now/CVE-2025-58610.md): WordPress Gallery PhotoBlocks Plugin \<= 1.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-47439](https://cve.now/CVE-2025-47439.md): WordPress Download Monitor plugin \<= 5.0.22 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-32233](https://cve.now/CVE-2025-32233.md): WordPress Revive.so plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-26975](https://cve.now/CVE-2025-26975.md): WordPress Strong Testimonials plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-24683](https://cve.now/CVE-2025-24683.md): WordPress RSVP and Event Management Plugin \<= 2.7.14 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-22773](https://cve.now/CVE-2025-22773.md): WordPress Htaccess File Editor \<= 1.0.19 - Broken Authentication vulnerability (CVSS 5.3)
- [CVE-2023-46083](https://cve.now/CVE-2023-46083.md): WordPress Kali Forms plugin \<= 2.3.27 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-45275](https://cve.now/CVE-2023-45275.md): WordPress Contact Form builder with drag & drop plugin \<= 2.3.28 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-49256](https://cve.now/CVE-2024-49256.md): WordPress Htaccess File Editor plugin \<= 1.0.18 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2024-47362](https://cve.now/CVE-2024-47362.md): WordPress Strong Testimonials plugin \<= 3.1.16 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-43329](https://cve.now/CVE-2024-43329.md): WordPress Allegiant theme \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-43216](https://cve.now/CVE-2024-43216.md): WordPress Filr plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-28171](https://cve.now/CVE-2023-28171.md): WordPress Brilliance Theme \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wp-chill
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.