Skip to content
OpenAdvisories

Vendor

WP Chill

58 known vulnerabilities.

WP Chill at a glance

Last 12 months
43
Critical · all time
0
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 2 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities February 2026: 4 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 4 vulnerabilities May 2026: 2 vulnerabilities June 2026: 3 vulnerabilities Jun July 2026: 4 vulnerabilities August 2026: 1 vulnerability September 2026: 3 vulnerabilities Sep October 2026: 13 vulnerabilities November 2026: 4 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202640
Oct 2026130
Sep 202630
Aug 202610
Jul 202640
Jun 202630
May 202620
Apr 202640
Mar 202610
Feb 202640
Jan 202620
Dec 202520
Nov 202500
Oct 202500
Sep 202530
Aug 202500
Jul 202500
Jun 202500
May 202510
Apr 202510
Mar 202500
Feb 202510
Jan 202540
Dec 202400

Products

Strong Testimonials 11 Passster 7 Modula Image Gallery 6 Gallery PhotoBlocks 6 Kali Forms 5 Image Photo Gallery Final Tiles Grid 4 RSVP and Event Management 4 Download Monitor 4 Revive.so 3 Filr 3 Htaccess File Editor 2 Brilliance 1 Allegiant 1 Download Monitor integration for WooCommerce 1
All Critical High Medium Low Exploited only Public exploit

58 results · Feed

  • Medium 6.5
    CVE-2026-125454

    WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

    WP Chill Passster
  • Medium 5.3
    CVE-2026-121028

    WordPress Strong Testimonials plugin <= 3.3.17 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimonials allows Code Injection.This issue affects Strong Testimonials: from n/a through 3.3.17.

    WP Chill Strong Testimonials
  • Medium 5.3
    CVE-2026-121574

    WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

    WP Chill Passster
  • High 7.1
    CVE-2026-121570

    WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.

    WP Chill RSVP and Event Management
  • Medium 6.5
    CVE-2026-114706

    WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

    WP Chill Strong Testimonials
  • Medium 6.5
    CVE-2026-116408

    WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

    WP Chill Gallery PhotoBlocks
  • Medium 6.5
    CVE-2026-114710

    WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.

    WP Chill Gallery PhotoBlocks
  • Medium 4.3
    CVE-2026-112843

    WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.

    WP Chill Strong Testimonials
  • High 7.1
    CVE-2026-107435

    WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.

    WP Chill Strong Testimonials
  • High 8.8
    CVE-2026-107436

    WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

    WP Chill Strong Testimonials
  • Medium 5.3
    CVE-2026-110896 Public exploit

    WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.

    WP Chill Passster
  • Medium 6.5
    CVE-2026-110375

    WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.

    WP Chill Download Monitor
  • Medium 5.4
    CVE-2026-109897

    WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

    WP Chill Strong Testimonials
  • Medium 4.3
    CVE-2026-110371

    WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

    WP Chill Strong Testimonials
  • Medium 4.3
    CVE-2026-109896

    WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Monitor integration f…

    WP Chill Download Monitor integration for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-105876

    WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.

    WP Chill Modula Image Gallery
  • Medium 6.5
    CVE-2026-104409

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n…

    WP Chill Image Photo Gallery Final Tiles Grid
  • Medium 6.5
    CVE-2026-97286 Public exploit

    WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

    WP Chill Strong Testimonials
  • Medium 5.3
    CVE-2026-62114

    WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

    WP Chill Passster
  • Medium 6.5
    CVE-2026-84781

    WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

    WP Chill Gallery PhotoBlocks
  • Medium 5.3
    CVE-2026-81276

    WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

    WP Chill Kali Forms
  • High 7.1
    CVE-2026-65446

    WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

    WP Chill Kali Forms
  • Medium 6.5
    CVE-2026-66448

    WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

    WP Chill Gallery PhotoBlocks
  • Medium 6.5
    CVE-2026-65475

    WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

    WP Chill Modula Image Gallery
  • High 7.7
    CVE-2026-59542

    WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability

    Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

    WP Chill Kali Forms
  • Medium 6.5
    CVE-2026-42688

    WordPress Modula Image Gallery plugin <= 2.14.23 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

    WP Chill Modula Image Gallery
  • Medium 4.4
    CVE-2026-39489

    WordPress Download Monitor plugin <= 5.1.9 - Non-Arbitrary File Download vulnerability

    Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

    WP Chill Download Monitor
  • High 7.2
    CVE-2026-39481

    WordPress Modula Image Gallery plugin <= 2.14.18 - PHP Object Injection vulnerability

    Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.

    WP Chill Modula Image Gallery
  • Medium 5.3
    CVE-2026-27398

    WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.

    WP Chill RSVP and Event Management
  • Medium 4.3
    CVE-2026-27424

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.

    WP Chill Image Photo Gallery Final Tiles Grid
  • Medium 5.3
    CVE-2026-39561

    WordPress Revive.so plugin <= 2.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through <= 2.0.7.

    WP Chill Revive.so
  • Medium 5.3
    CVE-2026-39536

    WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.

    WP Chill RSVP and Event Management
  • Low 2.7
    CVE-2026-39510

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final …

    WP Chill Image Photo Gallery Final Tiles Grid
  • High 8.5
    CVE-2026-39486

    WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This issue affects Download Monitor: from n/a through <= 5.1.8.

    WP Chill Download Monitor
  • High 8.5
    CVE-2026-28133

    WordPress Filr plugin <= 1.2.14 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in WP Chill Filr filr-protection allows Upload a Web Shell to a Web Server.This issue affects Filr: from n/a through <= 1.2.14.

    WP Chill Filr
  • Medium 4.3
    CVE-2026-25375

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Photo Gallery Final Tiles Grid: from n/a throug…

    WP Chill Image Photo Gallery Final Tiles Grid
  • Medium 6.5
    CVE-2026-25036

    WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through <= 4.2.25.

    WP Chill Passster
  • Medium 6.5
    CVE-2026-24957

    WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.

    WP Chill Strong Testimonials
  • Medium 4.3
    CVE-2026-24939

    WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.

    WP Chill Modula Image Gallery
  • Medium 6.5
    CVE-2026-24389

    WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows DOM-Based XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.2.

    WP Chill Gallery PhotoBlocks