Chimpstudio vulnerabilities
We track 14 vulnerabilities in Chimpstudio products across 8 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on July 22, 2026.
Latest Chimpstudio vulnerabilities
- 8.1 High severity
WP Foodbakery: Relative Path Traversal
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated
- 8.2 High severity
JobHunt Job Alerts: Missing Authorization
Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6.
- 9.8 Critical severity
Foodbakery Sticky Cart: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
- 9.8 Critical severity
FoodBakery: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
- 8.8 High severity
FoodBakery | Delivery Restaurant Directory…: Cross-Site Request Forgery
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbakery_var_backup_file_del
- 8.8 High severity
FoodBakery | Delivery Restaurant Directory…: Missing Authorization
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete,
- 7.5 High severity
CS Framework: External Control of File Name or Path
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to rea
- 8.8 High severity
CS Framework: Improper Limitation of a Pathname to a Restricted Directory
The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cs_widget_file_delete() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with
- 9.8 Critical severity
WP Real Estate Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticate
- 9.8 Critical severity
WP Directorybox Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attacke
- 9.8 Critical severity
WP Foodbakery: Authentication Bypass Using an Alternate Path or Channel
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authent
- 9.8 Critical severity
WP Foodbakery: Improper Privilege Management
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for una
- 9.8 Critical severity
WP Foodbakery: Unrestricted Upload of File with Dangerous Type
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers
- 9.8 Critical severity
WP Directorybox Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible fo