Threat database

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12.

Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.

CVE-2026-110375 is a stored cross-site scripting (XSS) vulnerability in the WP Chill Download Monitor plugin affecting versions from initial release up to 5.3.3. It involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level with potential impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data, so patch status is not confirmed. The affected versions are all versions prior to 5.3.4. There is no indication of known exploits in the wild or cloud service involvement. Mitigation should be guided by vendor advisories once available.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

CVE-2026-109896 is a missing authorization vulnerability in the WP Chill Download Monitor integration for WooCommerce plugin. It affects versions from the initial release up to 1.0.3. The flaw allows exploitation due to incorrectly configured access control security levels, potentially permitting unauthorized access to certain functionality. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or vendor advisory is provided in the input data.

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.

CVE-2026-104409 is a stored cross-site scripting (XSS) vulnerability in the WP Chill Image Photo Gallery Final Tiles Grid plugin. It affects versions from initial release up to 3.6.13. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges and requiring user interaction to execute malicious scripts. The CVSS score is 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in WP Chill Strong Testimonials plugin versions before 3.3.12. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of the affected web application.

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

CVE-2026-81276 is a medium severity vulnerability in WP Chill Kali Forms plugin versions up to 2.4.23. It involves unauthenticated broken access control (CWE-862), allowing unauthorized users to perform actions without proper authorization. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

Author Arbitrary File Download in Download Monitor <= 5.1.9 versions.

CVE-2026-39481 is a high-severity vulnerability in WP Chill's Modula Image Gallery plugin, affecting versions up to and including 2.14.18. It involves PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw can lead to complete compromise of confidentiality, integrity, and availability without user interaction and requires high privileges to exploit.