Log in Start free

WPChill

Products

ProductCVEsExploitedLatest
Download Monitor13–Oct 2, 2026
Kali Forms — Contact Form & Drag-and-Drop Builder10–Aug 1, 2026
Modula Image Gallery – Photo Grid & Video Gallery9–Oct 16, 2026
Strong Testimonials9–Oct 3, 2026
Image Photo Gallery Final Tiles Grid5–Aug 22, 2026
Passster – Password Protect Pages and Content4–Jan 28, 2026
Gallery PhotoBlocks (WordPress plugin)2–Sep 9, 2022
Image Gallery – Photo Grid & Video Gallery2–Dec 3, 2025
Simple Restrict2–Dec 10, 2024
Brilliance2–Jun 7, 2023
Remove Footer Credit1–Apr 15, 2024
RSVP and Event Management1–Jan 7, 2025
Affluent1–Jun 7, 2023
Transcend1–Jun 7, 2023
Allegiant1–Jun 7, 2023
CPO Companion1–Jan 10, 2023
CPO Content Types1–Apr 23, 2023
CPO Shortcodes1–Nov 22, 2023
CPO Shortcodes (WordPress plugin)1–Sep 23, 2022
Download Monitor (WordPress plugin)1–Jan 14, 2022
Filr – Secure document library1–Jan 17, 2026
Modula Image Gallery (WordPress plugin)1–Nov 18, 2022
Qyrr – simply and modern QR-Code creation1–Sep 30, 2025

Exploited and recent CVEs

  • CVE-2026-107659 High 7.5 Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT 0.3%
  • CVE-2026-96650 High 7.2 Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field 0.3%
  • CVE-2026-100182 High 7.2 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor 0.3%
  • CVE-2026-89406 High 7.5 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters 0.4%
  • CVE-2026-92713 High 8.1 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter 0.3%
  • CVE-2026-92622 Medium 6.4 Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute 0.3%
  • CVE-2026-4559 Medium 6.4 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute 0.3%
  • CVE-2026-16144 High 8.1 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter 1.2%
  • CVE-2026-15395 High 7.2 Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value 0.4%
  • CVE-2026-9107 Medium 6.4 Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter 0.4%
  • CVE-2026-3239 Medium 6.4 Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode 0.2%
  • CVE-2026-4401 Medium 5.4 Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling 0.2%
  • CVE-2026-3124 High 7.5 Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' 0.3%
  • CVE-2026-3584 Critical 9.8 Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process 7.4%
  • CVE-2026-1860 Medium 4.3 Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure 0.3%
  • CVE-2026-1254 Medium 4.3 Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing 0.2%
  • CVE-2025-14865 Medium 6.4 Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
  • CVE-2025-15466 Medium 5.4 Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management 0.2%
  • CVE-2025-14632 Medium 4.4 Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload 0.2%
  • CVE-2025-14426 Medium 4.3 Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update 0.2%
  • CVE-2025-13693 Medium 6.4 Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting 0.2%
  • CVE-2025-14455 Medium 5.4 Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management 0.3%
  • CVE-2025-14003 Medium 4.3 Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification 0.2%
  • CVE-2025-13891 Medium 6.5 Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing 0.4%
  • CVE-2025-13646 High 7.5 Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition 0.8%
  • CVE-2025-13645 High 7.2 Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion 1.1%
  • CVE-2025-12494 Medium 4.3 Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move 0.3%
  • CVE-2025-11268 Medium 4.3 Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution 0.3%
  • CVE-2025-10000 Medium 6.4 Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload 0.4%
  • CVE-2025-7367 Medium 6.4 Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields 0.3%