Wpchill vulnerabilities
71 CVEs and advisories name Wpchill as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-10000Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2025-7367Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields
- CVE-2024-9416Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library
- CVE-2024-6261Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2024-12853Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload
- CVE-2024-12711RSVP and Event Management <= 2.7.13 - Missing Authorization
- CVE-2024-11282Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11106Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-10399Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-10092Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation
- CVE-2022-4972Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export
- CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks
- CVE-2024-8552Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable
- CVE-2023-6491Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification
- CVE-2024-3269Download Monitor <= 4.9.13 - Missing Authorization
- CVE-2024-32429WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2026Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode
- CVE-2024-30501WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability
- CVE-2024-1083Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-1218Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
- CVE-2024-1217Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation
- CVE-2024-0616Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure
- CVE-2022-45354WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure
- CVE-2023-52123WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-34007WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload
- CVE-2023-5704CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2023-31219WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)
- CVE-2023-26013WordPress Strong Testimonials Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2020-36721Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation
- CVE-2020-36717Kali Forms <= 2.1.1 - Cross-Site Request Forgery