Vulnerabilities > Wpchill

DATE CVE VULNERABILITY TITLE RISK
2023-06-16 CVE-2023-26013 Cross-site Scripting vulnerability in Wpchill Strong Testimonials
Auth.
network
low complexity
wpchill CWE-79
5.4
2023-04-23 CVE-2023-25451 Cross-site Scripting vulnerability in Wpchill CPO Content Types
Auth.
network
low complexity
wpchill CWE-79
4.8
2023-01-16 CVE-2022-4544 Unspecified vulnerability in Wpchill Mashshare
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
network
low complexity
wpchill
5.4
2022-11-18 CVE-2022-41135 Unspecified vulnerability in Wpchill Customizable Wordpress Gallery Plugin - Modula Image Gallery
Unauth.
network
low complexity
wpchill
5.3
2022-10-10 CVE-2022-2981 Files or Directories Accessible to External Parties vulnerability in Wpchill Download Monitor
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
network
low complexity
wpchill CWE-552
4.9
2022-07-17 CVE-2022-2222 Files or Directories Accessible to External Parties vulnerability in Wpchill Download Monitor
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
network
low complexity
wpchill CWE-552
4.0
2022-05-23 CVE-2022-1547 Cross-site Scripting vulnerability in Wpchill Check & LOG Email
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
network
wpchill CWE-79
4.3
2022-04-18 CVE-2022-1054 Missing Authorization vulnerability in Wpchill Rsvp and Event Management
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action.
network
low complexity
wpchill CWE-862
5.0
2022-04-15 CVE-2022-27852 Cross-site Scripting vulnerability in Wpchill KB Support
Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.
network
low complexity
wpchill CWE-79
6.1
2022-02-14 CVE-2021-24446 Cross-Site Request Forgery (CSRF) vulnerability in Wpchill Remove Footer Credit
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
network
wpchill CWE-352
6.0