CVE-2026-92622Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute Exploitation status Not confirmed Fix Affected product S Strong Testimonials Published 09/18/2026 Severity Medium CVE-2026-4559Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute Exploitation status Not known exploited Fix Affected product I Image Photo Gallery Final Tiles Grid Published 08/22/2026 Severity Medium CVE-2026-16144Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 08/01/2026 Severity High CVE-2026-15395Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 07/17/2026 Severity High CVE-2026-9107Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 07/01/2026 Severity Medium CVE-2026-3239Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcode Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 04/08/2026 Severity Medium CVE-2026-4401Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling Exploitation status Not known exploited Fix Affected product D Download Monitor Published 04/07/2026 Severity Medium CVE-2026-3124Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' Exploitation status Not known exploited Fix Affected product D Download Monitor Published 03/30/2026 Severity High CVE-2026-3584Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 03/20/2026 Severity Critical CVE-2026-1860Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 02/18/2026 Severity Medium CVE-2026-1254Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 02/14/2026 Severity Medium CVE-2025-14865Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product P Passster – Password Protect Pages and Content Published 01/28/2026 Severity Medium CVE-2025-15466Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management Exploitation status Not known exploited Fix Affected product I Image Photo Gallery Final Tiles Grid Published 01/19/2026 Severity Medium CVE-2025-14632Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload Exploitation status Not known exploited Fix Affected product F Filr – Secure document library Published 01/17/2026 Severity Medium CVE-2025-14426Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 12/30/2025 Severity Medium CVE-2025-13693Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting Exploitation status Not known exploited Fix Affected product I Image Photo Gallery Final Tiles Grid Published 12/21/2025 Severity Medium CVE-2025-14455Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management Exploitation status Not known exploited Fix Affected product I Image Photo Gallery Final Tiles Grid Published 12/19/2025 Severity Medium CVE-2025-14003Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 12/15/2025 Severity Medium CVE-2025-13891Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 12/12/2025 Severity Medium CVE-2025-13646Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition Exploitation status Not known exploited Fix Affected product I Image Gallery – Photo Grid & Video Gallery Published 12/03/2025 Severity High CVE-2025-13645Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product I Image Gallery – Photo Grid & Video Gallery Published 12/03/2025 Severity High CVE-2025-12494Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 11/15/2025 Severity Medium CVE-2025-11268Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 11/06/2025 Severity Medium CVE-2025-10000Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product Q Qyrr – simply and modern QR-Code creation Published 09/30/2025 Severity Medium CVE-2025-7367Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 07/15/2025 Severity Medium CVE-2024-9416Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 04/03/2025 Severity Medium CVE-2024-6261Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product I Image Photo Gallery Final Tiles Grid Published 02/27/2025 Severity Medium CVE-2025-24683WordPress RSVP and Event Management Plugin <= 2.7.14 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product R RSVP and Event Management Published 01/24/2025 Severity High CVE-2025-22773WordPress Htaccess File Editor <= 1.0.19 - Broken Authentication vulnerability Exploitation status Not known exploited Fix Affected product H Htaccess File Editor Published 01/15/2025 Severity Medium CVE-2024-12853Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product M Modula Image Gallery – Photo Grid & Video Gallery Published 01/08/2025 Severity High CVE-2024-12711RSVP and Event Management <= 2.7.13 - Missing Authorization Exploitation status Not known exploited Fix Affected product R RSVP and Event Management Published 01/07/2025 Severity Medium CVE-2024-11282Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Passster – Password Protect Pages and Content Published 01/07/2025 Severity Medium CVE-2024-11106Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product S Simple Restrict Published 12/10/2024 Severity Medium CVE-2024-49256WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product H Htaccess File Editor Published 11/01/2024 Severity Medium CVE-2024-47362WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 11/01/2024 Severity Medium CVE-2024-10399Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product D Download Monitor Published 10/30/2024 Severity Medium CVE-2024-10092Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation Exploitation status Not known exploited Fix Affected product D Download Monitor Published 10/26/2024 Severity Medium CVE-2022-4972Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export Exploitation status Not known exploited Fix Affected product D Download Monitor Published 10/16/2024 Severity High CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks Exploitation status Not known exploited Fix Affected product F Filr – Secure document library Published 10/16/2024 Severity Medium CVE-2024-8552Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable Exploitation status Not known exploited Fix Affected product D Download Monitor Published 09/26/2024 Severity Medium CVE-2024-6571Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure Exploitation status Not known exploited Fix Affected product I Image SEO – AI-Driven Image SEO Optimizer Published 07/24/2024 Severity Medium CVE-2024-3710Image Photo Gallery Final Tiles Grid < 3.6.0 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product I Image Photo Gallery Final Tiles Grid Published 07/13/2024 Severity Medium CVE-2023-6491Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 06/07/2024 Severity Medium CVE-2024-3269Download Monitor <= 4.9.13 - Missing Authorization Exploitation status Not known exploited Fix Affected product D Download Monitor Published 05/30/2024 Severity Medium CVE-2024-3261Strong Testimonials < 3.1.12 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product S Strong Testimonials Published 04/24/2024 Severity Medium CVE-2024-32429WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product R Remove Footer Credit Published 04/15/2024 Severity Medium CVE-2024-2026Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode Exploitation status Not known exploited Fix Affected product P Passster – Password Protect Pages and Content Published 04/09/2024 Severity Medium CVE-2024-30501WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product D Download Monitor Published 03/29/2024 Severity High CVE-2024-1083Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product S Simple Restrict Published 03/13/2024 Severity Medium CVE-2024-1218Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 02/20/2024 Severity Medium CVE-2024-1217Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 02/20/2024 Severity High CVE-2024-0616Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Passster – Password Protect Pages and Content Published 02/20/2024 Severity Medium CVE-2022-45354WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure Exploitation status Not known exploited Fix Affected product D Download Monitor Published 01/08/2024 Severity Medium CVE-2023-52123WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 01/05/2024 Severity Medium CVE-2023-34007WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload Exploitation status Not confirmed Fix Affected product D Download Monitor Published 12/20/2023 Severity Critical CVE-2023-5704CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not confirmed Fix Affected product C CPO Shortcodes Published 11/22/2023 Severity Medium CVE-2023-31219WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF) Exploitation status Not known exploited Fix Affected product D Download Monitor Published 11/13/2023 Severity Medium CVE-2023-28171WordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product B Brilliance Published 06/22/2023 Severity Medium CVE-2023-26013WordPress Strong Testimonials Plugin <= 3.0.2 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Strong Testimonials Published 06/16/2023 Severity Medium CVE-2020-36721Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation Exploitation status Not known exploited Fix Affected product B Brilliance Published 06/07/2023 Severity Medium CVE-2020-36717Kali Forms <= 2.1.1 - Cross-Site Request Forgery Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 06/07/2023 Severity High CVE-2020-36720Kali Forms <= 2.1.1 - Missing Authorization to Settings Update Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 06/07/2023 Severity High CVE-2020-36712Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion Exploitation status Not known exploited Fix Affected product K Kali Forms — Contact Form & Drag-and-Drop Builder Published 06/07/2023 Severity High CVE-2020-36708Epsilon Framework Themes (Various Versions) - Function Injection Exploitation status Not known exploited Fix Affected product A Affluent Published 06/07/2023 Severity Critical CVE-2023-25451WordPress CPO Content Types Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C CPO Content Types Published 04/23/2023 Severity Medium CVE-2022-4544MashShare < 3.8.7 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product S Social Media Share Buttons | MashShare Published 01/16/2023 Severity Medium CVE-2023-0162CPO Companion <= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C CPO Companion Published 01/10/2023 Severity Medium CVE-2022-41135WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability Exploitation status Not known exploited Fix Affected product M Modula Image Gallery (WordPress plugin) Published 11/18/2022 Severity Medium CVE-2022-2981Download Monitor < 4.5.98 - Admin+ Arbitrary File Download Exploitation status Not confirmed Fix Affected product D Download Monitor Published 10/10/2022 Severity Unknown CVE-2022-40672WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Not confirmed Affected product C CPO Shortcodes (WordPress plugin) Published 09/23/2022 Severity Medium CVE-2022-37407WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities Exploitation status Not known exploited Fix Not confirmed Affected product G Gallery PhotoBlocks (WordPress plugin) Published 09/09/2022 Severity Medium CVE-2022-36292WordPress Gallery PhotoBlocks plugin <= 1.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities Exploitation status Not known exploited Fix Not confirmed Affected product G Gallery PhotoBlocks (WordPress plugin) Published 08/23/2022 Severity Medium CVE-2022-2222Download Monitor < 4.5.91 - Admin+ Arbitrary File Download Exploitation status Not confirmed Fix Affected product D Download Monitor Published 07/17/2022 Severity Unknown CVE-2022-1547Check & Log email < 1.0.6 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product C Check & Log Email Published 05/23/2022 Severity Unknown CVE-2022-1054RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export Exploitation status Not confirmed Fix Affected product R RSVP and Event Management Plugin Published 04/18/2022 Severity Unknown CVE-2022-27852WordPress KB Support plugin <= 1.5.5 - Multiple Unauth. Stored Cross-Site Scripting (XSS) vulnerabilities Exploitation status Not confirmed Fix Affected product K KB Support Published 04/15/2022 Severity Medium CVE-2021-25050Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product R Remove Footer Credit Published 02/14/2022 Severity Unknown CVE-2021-24446Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product R Remove Footer Credit Published 02/14/2022 Severity Unknown CVE-2021-31567WordPress Download Monitor plugin <= 4.4.6 - Authenticated Arbitrary File Download vulnerability Exploitation status Not known exploited Fix Affected product Not confirmed Published 01/28/2022 Severity Medium CVE-2021-23174WordPress Download Monitor plugin <= 4.4.6 - Auth. Stored Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product D Download Monitor Published 01/28/2022 Severity Low CVE-2021-36920WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product D Download Monitor (WordPress plugin) Published 01/14/2022 Severity Medium CVE-2021-24786Download Monitor < 4.4.5 - Admin+ SQL Injection Exploitation status Public exploit Fix Affected product D Download Monitor Published 01/03/2022 Severity High CVE-2021-24908Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product C Check & Log Email Published 11/29/2021 Severity Unknown CVE-2021-24774Check & Log Email < 1.0.3 - Admin+ SQL Injections Exploitation status Not confirmed Fix Affected product C Check & Log Email Published 10/25/2021 Severity Unknown CVE-2020-9003Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/20/2020 Severity Unknown CVE-2020-8549Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 02/03/2020 Severity Unknown 
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
