Wp Chill
Monthly
Stored cross-site scripting in the Strong Testimonials WordPress plugin through version 3.3.12 allows an attacker to place a script payload in testimonial content that executes when a victim views the rendered testimonial, potentially in an administrative or page-rendering context. This is a moderate-priority issue: exploitation depends on a victim viewing the stored content and on whether testimonial submission is reachable by low-privileged users; under the assessed vector the attacker needs at least low-privileged authenticated access, though a public front-end submission configuration can lower that barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
PHP Object Injection in the Modula Image Gallery WordPress plugin (versions ≤ 2.14.18) allows authenticated authors to trigger unsafe deserialization of attacker-controlled input, potentially leading to remote code execution, data tampering, or denial of service depending on available POP gadget chains in the WordPress environment. The flaw was disclosed by Patchstack and tracked as ENISA EUVD-2026-36940; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Stored cross-site scripting in the WP Chill Strong Testimonials WordPress plugin, affecting all versions through 3.3.15, lets an authenticated low-privilege user submit testimonial content that is rendered without proper neutralization, so script executes in the browser of any user - including an administrator - who views the affected page. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for a pre-existing account and for victim interaction, while the scope change means the injected script can act beyond the plugin's own component. No CISA KEV entry, public exploit reference or EPSS score was supplied in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-facing reference is the Patchstack advisory for the 3.3.15 release.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks plugin for WordPress, affecting versions through 1.3.7, allows a user holding a low-privilege WordPress account to persist malicious markup that executes in the browser of anyone who later views the affected gallery page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects a network-reachable flaw that requires an authenticated low-privilege account and victim interaction, but whose scope change means the injected script can act beyond the vulnerable plugin component. There is no CISA KEV entry and no public exploit identified at time of analysis, and Patchstack's advisory is the underlying report; the vulnerable field or parameter is not described in the available sources.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks WordPress plugin, affecting versions through 1.3.7, lets an authenticated low-privileged user persist script payloads that run in another user's browser when the affected gallery content is rendered. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting that impact lands in the viewer's session rather than in the plugin itself. No public exploit code has been identified at time of analysis, and no fixed version appears in the available sources, so the vendor's Patchstack advisory remains the authoritative reference for remediation status.
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauthenticated remote attackers to bypass the plugin's gated-content access controls and read content that the site owner intended to restrict. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no authentication, no user interaction, and no non-default configuration, but the impact is confined to low-level confidentiality loss - no data modification, code execution, or site takeover. There is no public exploit identified at time of analysis, and the flaw only matters on sites that actively use Passster's protection feature to gate content; sites that do not gate content with the plugin are unaffected.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
Unauthenticated information disclosure in the WP Chill Modula Image Gallery WordPress plugin (modula-best-grid-gallery) through version 3.0.11 lets remote attackers retrieve embedded sensitive data from a site without logging in or triggering any user interaction. The missing authorization check (CWE-862) affects an exposed plugin route, but impact is limited to low-confidentiality read access - there is no ability to modify content or execute code. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this is a moderate, not high, priority; any network-reachable WordPress site running the vulnerable plugin build is exposed, while sites on a patched release or without the plugin active are unaffected.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Cross-site scripting in the Strong Testimonials WordPress plugin (versions through 3.3.11) lets an authenticated attacker with Contributor-level privileges on a WordPress site inject content that executes as script when a victim-typically an administrator or editor-views the affected page or admin screen. Exploitation requires both a valid low-privilege account and victim interaction, which materially narrows real-world risk; no public exploit was identified at time of analysis and no CISA KEV listing or EPSS signal accompanies this CVE. The result is a moderate-severity, low-priority issue whose main danger is privilege escalation or session abuse against higher-privileged users on multi-author sites.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
Missing authorization in the WP Chill RSVP and Event Management WordPress plugin (versions through 2.7.16) enables unauthenticated remote attackers to perform unauthorized write operations by bypassing access control checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, zero-complexity, unauthenticated exploitation is possible against default plugin installations. Impact is limited to partial integrity degradation (I:L) with no confidentiality or availability loss; no public exploit has been identified at time of analysis and EPSS is very low at 0.03% (8th percentile).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
Missing authorization in WP Chill Revive.so plugin versions up to 2.0.7 allows unauthenticated remote attackers to bypass access controls and read sensitive information via incorrectly configured access control security levels. The vulnerability has an EPSS score of 0.02% (4th percentile), indicating minimal real-world exploitation probability despite the moderate CVSS 5.3 score. No public exploit code or active exploitation has been confirmed.
Information disclosure in WP Chill RSVP and Event Management plugin versions up to 2.7.16 exposes sensitive system data to unauthenticated remote attackers via unprotected endpoints. The vulnerability allows retrieval of embedded sensitive information without authentication or user interaction, affecting WordPress sites using the affected plugin versions. With EPSS scoring of 0.02% and no public exploit code identified, real-world exploitation risk is minimal despite the network-accessible attack vector.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.
Stored cross-site scripting in the Strong Testimonials WordPress plugin through version 3.3.12 allows an attacker to place a script payload in testimonial content that executes when a victim views the rendered testimonial, potentially in an administrative or page-rendering context. This is a moderate-priority issue: exploitation depends on a victim viewing the stored content and on whether testimonial submission is reachable by low-privileged users; under the assessed vector the attacker needs at least low-privileged authenticated access, though a public front-end submission configuration can lower that barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
PHP Object Injection in the Modula Image Gallery WordPress plugin (versions ≤ 2.14.18) allows authenticated authors to trigger unsafe deserialization of attacker-controlled input, potentially leading to remote code execution, data tampering, or denial of service depending on available POP gadget chains in the WordPress environment. The flaw was disclosed by Patchstack and tracked as ENISA EUVD-2026-36940; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Stored cross-site scripting in the WP Chill Strong Testimonials WordPress plugin, affecting all versions through 3.3.15, lets an authenticated low-privilege user submit testimonial content that is rendered without proper neutralization, so script executes in the browser of any user - including an administrator - who views the affected page. The assessed CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for a pre-existing account and for victim interaction, while the scope change means the injected script can act beyond the plugin's own component. No CISA KEV entry, public exploit reference or EPSS score was supplied in the available intelligence, so there is no public exploit identified at time of analysis; the vendor-facing reference is the Patchstack advisory for the 3.3.15 release.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks plugin for WordPress, affecting versions through 1.3.7, allows a user holding a low-privilege WordPress account to persist malicious markup that executes in the browser of anyone who later views the affected gallery page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects a network-reachable flaw that requires an authenticated low-privilege account and victim interaction, but whose scope change means the injected script can act beyond the vulnerable plugin component. There is no CISA KEV entry and no public exploit identified at time of analysis, and Patchstack's advisory is the underlying report; the vulnerable field or parameter is not described in the available sources.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks WordPress plugin, affecting versions through 1.3.7, lets an authenticated low-privileged user persist script payloads that run in another user's browser when the affected gallery content is rendered. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting that impact lands in the viewer's session rather than in the plugin itself. No public exploit code has been identified at time of analysis, and no fixed version appears in the available sources, so the vendor's Patchstack advisory remains the authoritative reference for remediation status.
Missing authorization in the WP Chill Passster WordPress plugin (content-protector) through version 4.3.18 allows unauthenticated remote attackers to bypass the plugin's gated-content access controls and read content that the site owner intended to restrict. According to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no authentication, no user interaction, and no non-default configuration, but the impact is confined to low-level confidentiality loss - no data modification, code execution, or site takeover. There is no public exploit identified at time of analysis, and the flaw only matters on sites that actively use Passster's protection feature to gate content; sites that do not gate content with the plugin are unaffected.
Stored cross-site scripting in the WP Chill Download Monitor WordPress plugin (versions through 5.3.3) lets an authenticated low-privilege user persist malicious script that executes in the browser of whoever later views the affected admin or front-end page. Exploitation requires a valid account on the target site with at least low-privilege posting capability plus a victim (typically an administrator) who views the tainted content, so risk concentrates on sites that allow open registration or run multi-author workflows. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) by the reporter, with scope change reflecting that the injected script runs in the victim's session context; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Missing authorization checks in the WP Chill Strong Testimonials WordPress plugin through version 3.3.12 allow an attacker who already holds a valid low-privilege account (CVSS PR:L, so network-reachable but authenticated) to invoke plugin functionality that lacks a proper capability check and read data they should not be able to access. Impact is confined to limited confidentiality loss - no integrity or availability effect, and no unauthenticated path - making this a low-to-moderate priority issue; the realistic prerequisite is open/self-service registration or an already-compromised subscriber-level credential. No public exploit code or confirmed active exploitation was identified at time of analysis.
An authenticated attacker with low privileges can bypass access controls in the WordPress plugin Download Monitor integration for WooCommerce versions up to 1.0.3, leading to unauthorized access to limited confidential information. This moderate-severity missing authorization flaw (CWE-862) requires a valid logged-in account and does not allow data modification or service disruption; no public exploit code has been identified at the time of analysis. The plugin must be installed alongside WooCommerce, and only sites running this specific integration are affected.
Unauthenticated information disclosure in the WP Chill Modula Image Gallery WordPress plugin (modula-best-grid-gallery) through version 3.0.11 lets remote attackers retrieve embedded sensitive data from a site without logging in or triggering any user interaction. The missing authorization check (CWE-862) affects an exposed plugin route, but impact is limited to low-confidentiality read access - there is no ability to modify content or execute code. No public exploit code has been identified at time of analysis and there is no indication of active exploitation, so this is a moderate, not high, priority; any network-reachable WordPress site running the vulnerable plugin build is exposed, while sites on a patched release or without the plugin active are unaffected.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (final-tiles-grid-gallery-lite, WP Chill) through version 3.6.13 lets an authenticated low-privileged user - a contributor, author, or equivalent role permitted to submit gallery content - inject script that is stored server-side and later rendered in the browser of any victim who views the affected gallery page, including administrators. Because the CVSS vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (score 6.5, Medium), successful exploitation requires a valid low-privileged account plus a second human interaction step (the victim loading the tainted page), and impact is confined to the victim's browser session rather than the underlying server. No public exploit code has been identified at time of analysis, and no CISA KEV entry indicates active exploitation; the risk is elevated on multi-author sites, membership sites, or any installation that allows untrusted users to register or post gallery content.
Cross-site scripting in the Strong Testimonials WordPress plugin (versions through 3.3.11) lets an authenticated attacker with Contributor-level privileges on a WordPress site inject content that executes as script when a victim-typically an administrator or editor-views the affected page or admin screen. Exploitation requires both a valid low-privilege account and victim interaction, which materially narrows real-world risk; no public exploit was identified at time of analysis and no CISA KEV listing or EPSS signal accompanies this CVE. The result is a moderate-severity, low-priority issue whose main danger is privilege escalation or session abuse against higher-privileged users on multi-author sites.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
Missing authorization in the WP Chill RSVP and Event Management WordPress plugin (versions through 2.7.16) enables unauthenticated remote attackers to perform unauthorized write operations by bypassing access control checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, zero-complexity, unauthenticated exploitation is possible against default plugin installations. Impact is limited to partial integrity degradation (I:L) with no confidentiality or availability loss; no public exploit has been identified at time of analysis and EPSS is very low at 0.03% (8th percentile).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
Missing authorization in WP Chill Revive.so plugin versions up to 2.0.7 allows unauthenticated remote attackers to bypass access controls and read sensitive information via incorrectly configured access control security levels. The vulnerability has an EPSS score of 0.02% (4th percentile), indicating minimal real-world exploitation probability despite the moderate CVSS 5.3 score. No public exploit code or active exploitation has been confirmed.
Information disclosure in WP Chill RSVP and Event Management plugin versions up to 2.7.16 exposes sensitive system data to unauthenticated remote attackers via unprotected endpoints. The vulnerability allows retrieval of embedded sensitive information without authentication or user interaction, affecting WordPress sites using the affected plugin versions. With EPSS scoring of 0.02% and no public exploit code identified, real-world exploitation risk is minimal despite the network-accessible attack vector.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.