Wp Chill
Monthly
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
PHP Object Injection in the Modula Image Gallery WordPress plugin (versions ≤ 2.14.18) allows authenticated authors to trigger unsafe deserialization of attacker-controlled input, potentially leading to remote code execution, data tampering, or denial of service depending on available POP gadget chains in the WordPress environment. The flaw was disclosed by Patchstack and tracked as ENISA EUVD-2026-36940; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
Missing authorization in the WP Chill RSVP and Event Management WordPress plugin (versions through 2.7.16) enables unauthenticated remote attackers to perform unauthorized write operations by bypassing access control checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, zero-complexity, unauthenticated exploitation is possible against default plugin installations. Impact is limited to partial integrity degradation (I:L) with no confidentiality or availability loss; no public exploit has been identified at time of analysis and EPSS is very low at 0.03% (8th percentile).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
Missing authorization in WP Chill Revive.so plugin versions up to 2.0.7 allows unauthenticated remote attackers to bypass access controls and read sensitive information via incorrectly configured access control security levels. The vulnerability has an EPSS score of 0.02% (4th percentile), indicating minimal real-world exploitation probability despite the moderate CVSS 5.3 score. No public exploit code or active exploitation has been confirmed.
Information disclosure in WP Chill RSVP and Event Management plugin versions up to 2.7.16 exposes sensitive system data to unauthenticated remote attackers via unprotected endpoints. The vulnerability allows retrieval of embedded sensitive information without authentication or user interaction, affecting WordPress sites using the affected plugin versions. With EPSS scoring of 0.02% and no public exploit code identified, real-world exploitation risk is minimal despite the network-accessible attack vector.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
PHP Object Injection in the Modula Image Gallery WordPress plugin (versions ≤ 2.14.18) allows authenticated authors to trigger unsafe deserialization of attacker-controlled input, potentially leading to remote code execution, data tampering, or denial of service depending on available POP gadget chains in the WordPress environment. The flaw was disclosed by Patchstack and tracked as ENISA EUVD-2026-36940; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Blind SQL injection in the WP Chill Download Monitor plugin for WordPress affects all versions from an unspecified early release through 5.1.8, letting an authenticated attacker inject crafted SQL into a database query and infer or exfiltrate backend data. The CVSS 3.1 base score is 8.5 (scope-changed) and Patchstack is the reporting source; there is no public exploit identified at time of analysis and the EPSS probability is very low at 0.02% (6th percentile). CISA SSVC scores exploitation as none, non-automatable, with partial technical impact, indicating a credible but not yet weaponized data-disclosure flaw.
Broken access control in the Passster WordPress content-protection plugin (versions up to and including 4.3.13) allows unauthenticated remote attackers to read content that site owners have restricted behind passwords. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify entitlement before serving protected material, directly undermining its core security purpose. No public exploit or CISA KEV listing exists at time of analysis, and impact is limited to partial confidentiality with no integrity or availability effect.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Path traversal in the WordPress Download Monitor plugin (versions <= 5.1.9, by WP Chill) allows a network-accessible attacker with Author-level WordPress credentials to download arbitrary files from the server, achieving high confidentiality impact. The vulnerability (CWE-22) stems from improper sanitization of file paths within the plugin's download functionality, enabling directory traversal outside the intended file scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS data was provided to quantify exploitation probability.
Missing authorization in the WP Chill RSVP and Event Management WordPress plugin (versions through 2.7.16) enables unauthenticated remote attackers to perform unauthorized write operations by bypassing access control checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms fully remote, zero-complexity, unauthenticated exploitation is possible against default plugin installations. Impact is limited to partial integrity degradation (I:L) with no confidentiality or availability loss; no public exploit has been identified at time of analysis and EPSS is very low at 0.03% (8th percentile).
Missing Authorization in the Image Photo Gallery Final Tiles Grid WordPress plugin (by WP Chill) allows low-privileged authenticated attackers to exploit incorrectly configured access control, resulting in unauthorized read access to restricted data. All plugin versions through 3.6.11 are affected per NVD and Patchstack. No public exploit identified at time of analysis, and the limited confidentiality impact (C:L) and authentication requirement (PR:L) constrain real-world blast radius, though the vulnerability remains a valid risk for multi-tenant or shared-access WordPress deployments.
Missing authorization in WP Chill Revive.so plugin versions up to 2.0.7 allows unauthenticated remote attackers to bypass access controls and read sensitive information via incorrectly configured access control security levels. The vulnerability has an EPSS score of 0.02% (4th percentile), indicating minimal real-world exploitation probability despite the moderate CVSS 5.3 score. No public exploit code or active exploitation has been confirmed.
Information disclosure in WP Chill RSVP and Event Management plugin versions up to 2.7.16 exposes sensitive system data to unauthenticated remote attackers via unprotected endpoints. The vulnerability allows retrieval of embedded sensitive information without authentication or user interaction, affecting WordPress sites using the affected plugin versions. With EPSS scoring of 0.02% and no public exploit code identified, real-world exploitation risk is minimal despite the network-accessible attack vector.
WP Chill Image Photo Gallery Final Tiles Grid plugin versions up to 3.6.11 allow authenticated high-privilege administrators to modify image gallery settings through improper access control checks on user-supplied parameters, enabling limited integrity compromise of gallery configurations. The vulnerability has an extremely low EPSS score (0.02%, 4th percentile) and requires high-privilege credentials (PR:H), significantly limiting real-world exploitability despite network accessibility.