WPChill — Vulnerabilities & Security Advisories 66

Browse all 66 CVE security advisories affecting WPChill. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WPChill operates as a developer of premium WordPress plugins, primarily focusing on e-commerce solutions, membership management, and digital product delivery. Security audits reveal a concerning history, with 57 recorded Common Vulnerabilities and Exposures (CVEs) associated with its software portfolio. These vulnerabilities predominantly stem from insufficient input validation and inadequate access controls, leading to frequent instances of Remote Code Execution (RCE), Cross-Site Scripting (XSS), and Privilege Escalation. Many flaws allow unauthenticated attackers to execute arbitrary code or manipulate administrative functions, highlighting systemic weaknesses in code review processes. While the company provides technical support, the high volume of disclosed CVEs suggests a reactive rather than proactive security posture. Users of WPChill products face significant risk, necessitating rigorous patch management and continuous monitoring to mitigate potential exploitation of these historically common attack vectors.

Found 10 results / 66 Clear Filters

Top products by WPChill: Download Monitor Kali Forms — Contact Form & Drag-and-Drop Builder Strong Testimonials Modula Image Gallery – Photo Grid & Video Gallery Image Photo Gallery Final Tiles Grid Passster – Password Protect Pages and Content Gallery PhotoBlocks (WordPress plugin) Image Gallery – Photo Grid & Video Gallery Simple Restrict Filr – Secure document library CPO Content Types Qyrr – simply and modern QR-Code creation RSVP and Event Management Remove Footer Credit CPO Shortcodes Brilliance CPO Companion Modula Image Gallery (WordPress plugin) CPO Shortcodes (WordPress plugin) Download Monitor (WordPress plugin)

CVEs 66

CVE ID	Title	CVSS	Severity	Published
CVE-2026-16144	Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-94	8.1	High	2026-08-01
CVE-2026-15395	Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-79	7.2	High	2026-07-17
CVE-2026-9107	Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-79	6.4	Medium	2026-07-01
CVE-2026-3584	Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-94	9.8	Critical	2026-03-20
CVE-2026-1860	Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-862	4.3	Medium	2026-02-18
CVE-2024-1218	Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-862	4.3	Medium	2024-02-20
CVE-2024-1217	Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-862	7.6	High	2024-02-20
CVE-2020-36717	Kali Forms <= 2.1.1 - Cross-Site Request Forgery — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-352	8.8	High	2023-06-07
CVE-2020-36720	Kali Forms <= 2.1.1 - Missing Authorization to Settings Update — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-862	7.1	High	2023-06-07
CVE-2020-36712	Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion — Kali Forms — Contact Form & Drag-and-Drop Builder CWE-862	8.6	High	2023-06-07

This page lists every published CVE security advisory associated with WPChill. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.