HighCVSS 7.7
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Vendor
Chimpstudio vulnerabilities
17 published CVES affecting Chimpstudio, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 17
- Critical
- 8
- High
- 7
- Medium
- 2
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- WP Foodbakery 6
- FoodBakery 3
- CS Framework 2
- FoodBakery | Delivery Restaurant Directory WordPress Theme 2
- WP Directorybox Manager 2
- Foodbakery Sticky Cart 1
- JobHunt Job Alerts 1
- WP Real Estate Manager 1
Latest Chimpstudio CVEs
Newest publication first
-
-
HighCVSS 8.1
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with sub...
-
CVE-2025-39536 WordPress JobHunt Job Alerts <= 3.6 - Arbitrary Content Deletion Vulnerability
PublishedHighCVSS 8.2Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6.
-
CriticalCVSS 9.8
Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through <= 3.3.
-
CVE-2025-39356 WordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability
PublishedCriticalCVSS 9.8Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through <= 3.2.
-
HighCVSS 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, e...
-
HighCVSS 8.8
The FoodBakery | Delivery Restaurant Directory WordPress Theme theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.7. This is due to missing or incorrect nonce validation on the foodbakery_var_backup_file_delete, foodbakery_widg...
-
HighCVSS 7.5
The CS Framework plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 6.9 via the get_widget_settings_json() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of ar...
-
HighCVSS 8.8
The CS Framework plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cs_widget_file_delete() function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Subscriber-level acc...
-
CriticalCVSS 9.8
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypas...
-
CriticalCVSS 9.8
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any...
-
CriticalCVSS 9.8
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authentication cookie. This...
-
CriticalCVSS 9.8
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attacke...
-
MediumCVSS 6.1
The WP Foodbakery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on the 'search_type' parameter. This makes it possible for unauthenticated attackers to inject a...
-
CriticalCVSS 9.8
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary...
-
CriticalCVSS 9.8
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible for unauthenticated at...
-
MediumCVSS 6.1
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.