Wpchill is a WordPress plugin developer with a focused portfolio of content management and user-engagement extensions such as Download Monitor, Strong Testimonials, Modula Image Gallery, Check & Log Email, and Passster. The vendor's disclosures cluster around application-layer input-handling and authorization weaknesses, with cross-site scripting, sensitive information exposure, missing authorization checks, and cross-site request forgery forming the recurring pattern across its plugin ecosystem. These weakness classes reflect the challenge of securing user-submitted content and administrative workflows in WordPress plugins, where improper input filtering and insufficient access controls create persistent exposure points. Defenders should treat this vendor's plugins as requiring regular updates and code review, particularly where plugins handle user uploads, form submissions, or administrative functions; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpchill over time
Signals from CVEs in this vendor scope (75 CVEs).
75 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-23174MEDIUM Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, & | Jan 28, 2022 | 4.8 | 64 | NO | NO |
CVE-2021-24786HIGH The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leadi | Jan 3, 2022 | 7.2 | 52 | NO | YES |
CVE-2022-45354HIGH Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60. | Jan 8, 2024 | 7.5 | 50 | NO | YES |
CVE-2022-1054MEDIUM The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init | Apr 18, 2022 | 5.3 | 31 | NO | YES |
CVE-2026-65475MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS.
This issue affects Modula Im | Jul 23, 2026 | 6.5 | 27 | NO | NO |
CVE-2026-39486HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind SQL Injection.This iss | Apr 8, 2026 | 8.5 | 27 | NO | NO |
CVE-2026-3124HIGH The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to mis | Mar 30, 2026 | 7.5 | 27 | NO | NO |
CVE-2022-36292HIGH Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. | Aug 23, 2022 | 8.8 | 27 | NO | NO |
CVE-2026-23976HIGH Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This | Jan 22, 2026 | 7.1 | 26 | NO | NO |
CVE-2025-13645HIGH The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1 | Dec 3, 2025 | 7.2 | 26 | NO | NO |
Signals from CVEs in this vendor scope (75 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpchill.
Media articles that mention a CVE ID that affects a product developed by Wpchill — matched by CVE ID, not by vendor name.