CveMateVulnerability intelligence

Wpchill vulnerabilities

89 vulnerabilities

Known vulnerabilities in Wpchill products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 33 products.

Products

33

Download Monitor18 vulnerabilities
Strong Testimonials12 vulnerabilities
Kali Forms — Contact Form & Drag And Drop Builder10 vulnerabilities
Modula Image Gallery – Photo Grid & Video Gallery9 vulnerabilities
Image Photo Gallery Final Tiles Grid7 vulnerabilities
Modula Image Gallery5 vulnerabilities
Passster – Password Protect Pages And Content5 vulnerabilities
Brilliance3 vulnerabilities
Check \& Log Email3 vulnerabilities
Gallery Photoblocks3 vulnerabilities
Passster3 vulnerabilities
Remove Footer Credit3 vulnerabilities
Cpo Shortcodes2 vulnerabilities
Filr – Secure Document Library2 vulnerabilities
Gallery Photoblocks (Wordpress Plugin)2 vulnerabilities
Image Gallery – Photo Grid & Video Gallery2 vulnerabilities
Qyrr – Simply And Modern QR Code Creation2 vulnerabilities
Rsvp And Event Management2 vulnerabilities
Simple Restrict2 vulnerabilities
Affluent1 vulnerabilities
Allegiant1 vulnerabilities
CPO Companion1 vulnerabilities
Cpo Content Types1 vulnerabilities
CPO Shortcodes (Wordpress Plugin)1 vulnerabilities
Customizable Wordpress Gallery Plugin Modula Image Gallery1 vulnerabilities
Download Monitor (Wordpress Plugin)1 vulnerabilities
Htaccess File Editor1 vulnerabilities
Kb Support1 vulnerabilities
Lightbox – Everlightbox Gallery1 vulnerabilities
Mashshare1 vulnerabilities
Modula Image Gallery (Wordpress Plugin)1 vulnerabilities
Optimize Images Alt Text \(Alt Tag\) \& Names For Seo Using Ai1 vulnerabilities
Transcend1 vulnerabilities

CVE-2026-107659wpchillmodula image gallery – photo grid & video gallery5d ago16-10-2026 04:27

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.CVE-2021-31567wordpressdownload-monitor+14y ago28-01-2022 19:09

Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.CVE-2021-36920wordpressdownload-monitor+24y ago14-01-2022 19:11

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability discovered in WordPress plugin Download Monitor (versions <= 4.4.6).CVE-2021-25050unknownremove footer credit+24y ago14-02-2022 09:20

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.CVE-2021-24908unknowncheck & log email+24y ago29-11-2021 08:25

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting CVE-2021-24774unknowncheck & log email+24y ago25-10-2021 13:20

The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues CVE-2021-24786unknowndownload monitor+24y ago03-01-2022 12:49

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue CVE-2021-24446unknownremove footer credit+24y ago14-02-2022 09:20

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation CVE-2021-23174wordpressdownload-monitor+14y ago28-01-2022 19:09

Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].CVE-2025-13646wordpressmodula-best-grid-gallery+210mo ago03-12-2025 02:25

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files with race condition on the affected site's server which may make remote code execution possible.CVE-2025-13891wordpressmodula-best-grid-gallery+110mo ago12-12-2025 07:20

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due to the modula_list_folders AJAX endpoint that lacks proper path validation and base directory restrictions. While the endpoint verifies user capabilities (Author+ with upload_files and edit_posts permissions), it fails to validate that user-supplied directory paths reside within safe directories. This makes it possible for authenticated attackers, with Author-level access and above, to enumerate arbitrary directories on the server via the modula_list_folders endpoint.CVE-2025-13693wordpressfinal-tiles-grid-gallery-lite+110mo ago21-12-2025 03:20

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-13645wordpressmodula-best-grid-gallery+210mo ago03-12-2025 02:25

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.13.2. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).CVE-2025-11268wordpressstrong-testimonials+111mo ago06-11-2025 08:26

The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.CVE-2025-14426wordpressstrong-testimonials+19mo ago30-12-2025 12:22

The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers with Contributor-level access and above to modify or delete the rating meta on any testimonial post, including those created by other users, by reusing a valid nonce obtained from their own testimonial edit screen.CVE-2025-14455wordpressfinal-tiles-grid-gallery-lite+110mo ago19-12-2025 09:29

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete, modify, or clone galleries created by any user, including administrators.CVE-2025-14632wordpressfilr-protection+19mo ago17-01-2026 02:22

The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and including, 1.2.11 due to insufficient file type restrictions in the FILR_Uploader class. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload malicious HTML files containing JavaScript that will execute whenever a user accesses the uploaded file, granted they have permission to create or edit posts with the 'filr' post type.CVE-2025-14865wordpresscontent-protector+18mo ago28-01-2026 12:28

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.2.21.CVE-2025-14003wordpressmodula-best-grid-gallery+110mo ago15-12-2025 14:25

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `add_images_to_gallery_callback()` function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with Author-level access and above, to add images to arbitrary Modula galleries owned by other users.CVE-2025-7367wordpressstrong-testimonials+11y ago15-07-2025 04:23

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Custom Fields in all versions up to, and including, 3.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.