# cve.now: Wpchill

The newest entries naming Wpchill as an affected vendor (up to 200), of 71 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121976](https://cve.now/CVE-2026-121976.md): Modula Image Gallery \<= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter (CVSS 6.4)
- [CVE-2026-115811](https://cve.now/CVE-2026-115811.md): Strong Testimonials \<= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star\_rating' Parameter (CVSS 7.2)
- [CVE-2026-107659](https://cve.now/CVE-2026-107659.md): Modula Image Gallery \<= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT (CVSS 7.5)
- [CVE-2026-96650](https://cve.now/CVE-2026-96650.md): Strong Testimonials \<= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform\_user\_photo' Custom Field (CVSS 7.2)
- [CVE-2026-100182](https://cve.now/CVE-2026-100182.md): Download Monitor \<= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor (CVSS 7.2)
- [CVE-2026-89406](https://cve.now/CVE-2026-89406.md): Modula Image Gallery \<= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula\_gallery\_id' and 'modula\_image\_id' Parameters (CVSS 7.5)
- [CVE-2026-92713](https://cve.now/CVE-2026-92713.md): Modula Image Gallery \<= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter (CVSS 8.1)
- [CVE-2026-92622](https://cve.now/CVE-2026-92622.md): Strong Testimonials \<= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox\_class' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-4559](https://cve.now/CVE-2026-4559.md): Image Photo Gallery Final Tiles Grid \<= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-16144](https://cve.now/CVE-2026-16144.md): Kali Forms \<= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter (CVSS 8.1)
- [CVE-2026-15395](https://cve.now/CVE-2026-15395.md): Kali Forms \<= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value (CVSS 7.2)
- [CVE-2026-9107](https://cve.now/CVE-2026-9107.md): Kali Forms \<= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms\_field\_components' Parameter (CVSS 6.4)
- [CVE-2026-3239](https://cve.now/CVE-2026-3239.md): Strong Testimonials \<= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial\_view Shortcode (CVSS 6.4)
- [CVE-2026-4401](https://cve.now/CVE-2026-4401.md): Download Monitor \<= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling (CVSS 5.4)
- [CVE-2026-3124](https://cve.now/CVE-2026-3124.md): Download Monitor \<= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order\_id' (CVSS 7.5)
- [CVE-2026-3584](https://cve.now/CVE-2026-3584.md): Kali Forms \<= 2.4.9 - Unauthenticated Remote Code Execution via form\_process (CVSS 9.8)
- [CVE-2026-1860](https://cve.now/CVE-2026-1860.md): Kali Forms \<= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure (CVSS 4.3)
- [CVE-2026-1254](https://cve.now/CVE-2026-1254.md): Modula Image Gallery – Photo Grid & Video Gallery \<= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing (CVSS 4.3)
- [CVE-2025-14865](https://cve.now/CVE-2025-14865.md): Passster – Password Protect Pages and Content \<= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-15466](https://cve.now/CVE-2025-15466.md): Image Photo Gallery Final Tiles Grid \<= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management (CVSS 5.4)
- [CVE-2025-14632](https://cve.now/CVE-2025-14632.md): Filr – Secure document library \<= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload (CVSS 4.4)
- [CVE-2025-14426](https://cve.now/CVE-2025-14426.md): Strong Testimonials \<= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update (CVSS 4.3)
- [CVE-2025-13693](https://cve.now/CVE-2025-13693.md): Image Photo Gallery Final Tiles Grid \<= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting (CVSS 6.4)
- [CVE-2025-14455](https://cve.now/CVE-2025-14455.md): Image Photo Gallery Final Tiles Grid \<= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management (CVSS 5.4)
- [CVE-2025-14003](https://cve.now/CVE-2025-14003.md): Image Gallery – Photo Grid & Video Gallery \<= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification (CVSS 4.3)
- [CVE-2025-13891](https://cve.now/CVE-2025-13891.md): Image Gallery – Photo Grid & Video Gallery (Modula) \<= 2.13.3 - Missing Authorization to Arbitrary Directory Listing (CVSS 6.5)
- [CVE-2025-13646](https://cve.now/CVE-2025-13646.md): Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition (CVSS 7.5)
- [CVE-2025-13645](https://cve.now/CVE-2025-13645.md): Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion (CVSS 7.2)
- [CVE-2025-12494](https://cve.now/CVE-2025-12494.md): Image Gallery – Photo Grid & Video Gallery \<= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move (CVSS 4.3)
- [CVE-2025-11268](https://cve.now/CVE-2025-11268.md): Strong Testimonials \<= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution (CVSS 4.3)
- [CVE-2025-10000](https://cve.now/CVE-2025-10000.md): Qyrr – simply and modern QR-Code creation \<= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 6.4)
- [CVE-2025-7367](https://cve.now/CVE-2025-7367.md): Strong Testimonials \<= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields (CVSS 6.4)
- [CVE-2024-9416](https://cve.now/CVE-2024-9416.md): Modula Image Gallery \<= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library (CVSS 6.4)
- [CVE-2024-6261](https://cve.now/CVE-2024-6261.md): Image Photo Gallery Final Tiles Grid \<= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12853](https://cve.now/CVE-2024-12853.md): Modula Image Gallery \<= 2.11.10 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-12711](https://cve.now/CVE-2024-12711.md): RSVP and Event Management \<= 2.7.13 - Missing Authorization (CVSS 5.3)
- [CVE-2024-11282](https://cve.now/CVE-2024-11282.md): Passster – Password Protect Pages and Content \<= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-11106](https://cve.now/CVE-2024-11106.md): Simple Restrict \<= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-10399](https://cve.now/CVE-2024-10399.md): Download Monitor \<= 5.0.13 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-10092](https://cve.now/CVE-2024-10092.md): Download Monitor \<= 5.0.12 - Missing Authorization to API Key Manipulation (CVSS 4.3)
- [CVE-2022-4972](https://cve.now/CVE-2022-4972.md): Download Monitor \<= 4.7.51 - Missing Authorization to Unauthenticated Data Export (CVSS 7.5)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-8552](https://cve.now/CVE-2024-8552.md): Download Monitor \<= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable (CVSS 4.3)
- [CVE-2023-6491](https://cve.now/CVE-2023-6491.md): Strong Testimonials \<= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification (CVSS 4.3)
- [CVE-2024-3269](https://cve.now/CVE-2024-3269.md): Download Monitor \<= 4.9.13 - Missing Authorization (CVSS 5.4)
- [CVE-2024-32429](https://cve.now/CVE-2024-32429.md): WordPress Remove Footer Credit plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-2026](https://cve.now/CVE-2024-2026.md): Passster \<= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content\_protector Shortcode (CVSS 6.4)
- [CVE-2024-30501](https://cve.now/CVE-2024-30501.md): WordPress Download Monitor theme \<= 4.9.4 - Auth. SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-1083](https://cve.now/CVE-2024-1083.md): Simple Restrict \<= 1.2.6 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-1218](https://cve.now/CVE-2024-1218.md): Contact Form builder with drag & drop for WordPress – Kali Forms \<= 2.3.41 - Missing Authorization (CVSS 4.3)
- [CVE-2024-1217](https://cve.now/CVE-2024-1217.md): Contact Form builder with drag & drop for WordPress – Kali Forms \<= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation (CVSS 7.6)
- [CVE-2024-0616](https://cve.now/CVE-2024-0616.md): Passster – Password Protect Pages and Content \<= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2022-45354](https://cve.now/CVE-2022-45354.md): WordPress Download Monitor Plugin \<= 4.7.60 is vulnerable to Sensitive Data Exposure (CVSS 5.3)
- [CVE-2023-52123](https://cve.now/CVE-2023-52123.md): WordPress Strong Testimonials Plugin \<= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-34007](https://cve.now/CVE-2023-34007.md): WordPress Download Monitor Plugin \<= 4.8.3 is vulnerable to Arbitrary File Upload (CVSS 9.9)
- [CVE-2023-5704](https://cve.now/CVE-2023-5704.md): CPO Shortcodes \<= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-31219](https://cve.now/CVE-2023-31219.md): WordPress Download Monitor Plugin \<= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.1)
- [CVE-2023-26013](https://cve.now/CVE-2023-26013.md): WordPress Strong Testimonials Plugin \<= 3.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2020-36721](https://cve.now/CVE-2020-36721.md): Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation (CVSS 6.5)
- [CVE-2020-36717](https://cve.now/CVE-2020-36717.md): Kali Forms \<= 2.1.1 - Cross-Site Request Forgery (CVSS 8.8)
- [CVE-2020-36720](https://cve.now/CVE-2020-36720.md): Kali Forms \<= 2.1.1 - Missing Authorization to Settings Update (CVSS 7.1)
- [CVE-2020-36712](https://cve.now/CVE-2020-36712.md): Kali Forms \<= 2.1.1 - Unauthenticated Arbitrary Post Deletion (CVSS 8.6)
- [CVE-2020-36708](https://cve.now/CVE-2020-36708.md): Epsilon Framework Themes (Various Versions) - Function Injection (CVSS 9.8)
- [CVE-2023-25451](https://cve.now/CVE-2023-25451.md): WordPress CPO Content Types Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-0162](https://cve.now/CVE-2023-0162.md): CPO Companion \<= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2022-41135](https://cve.now/CVE-2022-41135.md): WordPress Modula plugin \<= 2.6.9 - Unauth. Plugin Settings Change vulnerability (CVSS 6.5)
- [CVE-2022-40672](https://cve.now/CVE-2022-40672.md): WordPress CPO Shortcodes plugin \<= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
- [CVE-2022-37407](https://cve.now/CVE-2022-37407.md): WordPress Gallery PhotoBlocks plugin \<= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.1)
- [CVE-2022-36292](https://cve.now/CVE-2022-36292.md): WordPress Gallery PhotoBlocks plugin \<= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4)
- [CVE-2021-23174](https://cve.now/CVE-2021-23174.md): WordPress Download Monitor plugin \<= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 3.4)
- [CVE-2021-36920](https://cve.now/CVE-2021-36920.md): WordPress plugin Download Monitor \<= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wpchill
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.