# WP Chill vulnerabilities Source: https://junglewise.ai/threats/vendors/wp-chill Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wp-chill.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in WP Chill: 4 in the last 7 days and 15 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125454, was published on 11 November 2026. 9 vulnerabilities in the last four weeks, up 800% on the four before (1). 6 technologies have a page of their own. ## Counts - Last 7 days: 4 - Last 30 days: 12 - Last 90 days: 15 - All time: 26 (0 critical, 0 exploited in the wild) ## About WP Chill WP Chill is a software company that develops plugins for the WordPress content management system. ## Latest WP Chill vulnerabilities - [CVE-2026-125454: WP Chill Passster content-protector stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125454-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-121574: WP Chill Passster broken access control in content-protector](https://junglewise.ai/threats/cve-2026-121574-missing-authorization-vulnerability-in-wp-chill-passster-content) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-121028: WP Chill Strong Testimonials XSS in content injection](https://junglewise.ai/threats/cve-2026-121028-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-121570: WP Chill RSVP and Event Management stored XSS](https://junglewise.ai/threats/cve-2026-121570-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-114706: WP Chill Strong Testimonials stored cross-site scripting](https://junglewise.ai/threats/cve-2026-114706-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-116408: WP Chill Gallery PhotoBlocks stored cross-site scripting](https://junglewise.ai/threats/cve-2026-116408-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-114710: WP Chill Gallery PhotoBlocks stored XSS](https://junglewise.ai/threats/cve-2026-114710-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 26 Oct 2026) - [CVE-2026-112843: WP Chill Strong Testimonials broken access control](https://junglewise.ai/threats/cve-2026-112843-missing-authorization-vulnerability-in-wp-chill-strong) (medium, CVSS 4.3, published 22 Oct 2026) - [CVE-2026-107435: WP Chill Strong Testimonials stored cross-site scripting](https://junglewise.ai/threats/cve-2026-107435-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 21 Oct 2026) - [CVE-2026-107436: WP Chill Strong Testimonials object injection](https://junglewise.ai/threats/cve-2026-107436-deserialization-of-untrusted-data-vulnerability-in-wp-chill) (high, CVSS 8.8, published 18 Oct 2026) - [CVE-2026-110896: WP Chill Passster broken access control](https://junglewise.ai/threats/cve-2026-110896-missing-authorization-vulnerability-in-wp-chill-passster-content) (medium, CVSS 5.3, published 16 Oct 2026) - [CVE-2026-110375: WP Chill Download Monitor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-110375-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-109896: WP Chill Download Monitor integration for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-109896-missing-authorization-vulnerability-in-wp-chill-download-monitor) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-104409: WP Chill Image Photo Gallery Final Tiles Grid stored XSS](https://junglewise.ai/threats/cve-2026-104409-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-84781: Gallery PhotoBlocks contributor cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-84781-gallery-photoblocks-contributor-cross-site-scripting) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-66448: WP Chill Gallery PhotoBlocks Cross-Site Scripting in Contributor role](https://junglewise.ai/threats/cve-2026-66448-wp-chill-gallery-photoblocks-cross-site-scripting-in-contributor) (medium, CVSS 6.5, published 27 Jul 2026) - [CVE-2026-65475: WP Chill Modula Image Gallery Stored XSS](https://junglewise.ai/threats/cve-2026-65475-wp-chill-modula-image-gallery-stored-xss) (medium, CVSS 6.5, published 23 Jul 2026) - [CVE-2026-42688: WP Chill Modula Image Gallery Cross Site Scripting](https://junglewise.ai/threats/cve-2026-42688-wp-chill-modula-image-gallery-cross-site-scripting) (medium, CVSS 6.5, published 15 Jun 2026) - [CVE-2026-39489: WP Chill Download Monitor arbitrary file download in Author role](https://junglewise.ai/threats/cve-2026-39489-wp-chill-download-monitor-arbitrary-file-download-in-author-role) (medium, CVSS 4.4, published 15 Jun 2026) - [CVE-2026-39481: WP Chill Modula Image Gallery PHP object injection](https://junglewise.ai/threats/cve-2026-39481-wp-chill-modula-image-gallery-php-object-injection) (high, CVSS 7.2, published 15 Jun 2026) - [CVE-2026-27398: WP Chill RSVP and Event Management missing authorization](https://junglewise.ai/threats/cve-2026-27398-wp-chill-rsvp-and-event-management-missing-authorization) (medium, CVSS 5.3, published 25 May 2026) - [CVE-2026-27424: WP Chill Image Photo Gallery Final Tiles Grid missing authorization](https://junglewise.ai/threats/cve-2026-27424-wp-chill-image-photo-gallery-final-tiles-grid-missing) (medium, CVSS 4.3, published 20 May 2026) - [CVE-2026-39561: WP Chill Revive.so missing authorization in access control](https://junglewise.ai/threats/cve-2026-39561-wp-chill-revive-so-missing-authorization-in-access-control) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-39536: WP Chill RSVP and Event Management sensitive data exposure](https://junglewise.ai/threats/cve-2026-39536-wp-chill-rsvp-and-event-management-sensitive-data-exposure) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-39510: WP Chill Image Photo Gallery Final Tiles Grid IDOR in access control](https://junglewise.ai/threats/cve-2026-39510-wp-chill-image-photo-gallery-final-tiles-grid-idor-in-access) (low, CVSS 2.7, published 8 Apr 2026) ## Most severe WP Chill vulnerabilities - [CVE-2026-107436: WP Chill Strong Testimonials object injection](https://junglewise.ai/threats/cve-2026-107436-deserialization-of-untrusted-data-vulnerability-in-wp-chill) (high, CVSS 8.8, published 18 Oct 2026) - [CVE-2026-39486: WP Chill Download Monitor SQL injection](https://junglewise.ai/threats/cve-2026-39486-wp-chill-download-monitor-sql-injection) (high, CVSS 8.5, published 8 Apr 2026) - [CVE-2026-39481: WP Chill Modula Image Gallery PHP object injection](https://junglewise.ai/threats/cve-2026-39481-wp-chill-modula-image-gallery-php-object-injection) (high, CVSS 7.2, published 15 Jun 2026) - [CVE-2026-121570: WP Chill RSVP and Event Management stored XSS](https://junglewise.ai/threats/cve-2026-121570-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-107435: WP Chill Strong Testimonials stored cross-site scripting](https://junglewise.ai/threats/cve-2026-107435-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 21 Oct 2026) - [CVE-2026-84781: Gallery PhotoBlocks contributor cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-84781-gallery-photoblocks-contributor-cross-site-scripting) (medium, CVSS 6.5, published 2 Sep 2026) - [CVE-2026-110375: WP Chill Download Monitor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-110375-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-104409: WP Chill Image Photo Gallery Final Tiles Grid stored XSS](https://junglewise.ai/threats/cve-2026-104409-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-125454: WP Chill Passster content-protector stored cross-site scripting](https://junglewise.ai/threats/cve-2026-125454-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 11 Nov 2026) - [CVE-2026-114706: WP Chill Strong Testimonials stored cross-site scripting](https://junglewise.ai/threats/cve-2026-114706-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 29 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 800% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## WP Chill technologies - [WP Chill Strong Testimonials](https://junglewise.ai/threats/technologies/wp-chill-strong-testimonials): 5 vulnerabilities - [WP Chill Download Monitor](https://junglewise.ai/threats/technologies/download-monitor): 4 vulnerabilities - [WP Chill Gallery PhotoBlocks](https://junglewise.ai/threats/technologies/gallery-photoblocks): 4 vulnerabilities - [WP Chill Modula Image Gallery](https://junglewise.ai/threats/technologies/modula-image-gallery): 3 vulnerabilities - [WP Chill RSVP and Event Management](https://junglewise.ai/threats/technologies/rsvp-and-event-management): 3 vulnerabilities - [WP Chill Passster](https://junglewise.ai/threats/technologies/wp-chill-passster): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "WP Chill vulnerabilities", https://junglewise.ai/threats/vendors/wp-chill, 13 November 2026.