https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12526.htmlhttps://patchthecve.com/cve/CVE-2024-12526.htmlWed, 17 Jun 2026 06:59:53 +0000MEDIUM 4.3: The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfre_user_action' AJAX action. This makes it possible for unauthenticated atthttps://patchthecve.com/cve/CVE-2024-12463.htmlhttps://patchthecve.com/cve/CVE-2024-12463.htmlWed, 17 Jun 2026 06:59:45 +0000MEDIUM 6.4: The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_embed_amp' shortcode in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This mahttps://patchthecve.com/cve/CVE-2024-11384.htmlhttps://patchthecve.com/cve/CVE-2024-11384.htmlWed, 17 Jun 2026 06:57:39 +0000MEDIUM 6.4: The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in all versions up to, and including, 0.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it