https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67231.htmlhttps://patchthecve.com/cve/CVE-2025-67231.htmlWed, 17 Jun 2026 09:57:31 +0000MEDIUM 5.9: A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload.https://patchthecve.com/cve/CVE-2025-67230.htmlhttps://patchthecve.com/cve/CVE-2025-67230.htmlWed, 17 Jun 2026 09:57:31 +0000HIGH 7.1: Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with renderer-context access to invoke external protocol handlers without sufficient validation.https://patchthecve.com/cve/CVE-2025-67229.htmlhttps://patchthecve.com/cve/CVE-2025-67229.htmlWed, 17 Jun 2026 09:57:31 +0000CRITICAL 9.8: An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauthenticated, on-path attacker to spoof backend responses by exploiting insufficient certificate validation.https://patchthecve.com/cve/CVE-2024-56216.htmlhttps://patchthecve.com/cve/CVE-2024-56216.htmlWed, 17 Jun 2026 08:11:51 +0000MEDIUM 6.5: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Builder themify-builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through <= 7.6.3.https://patchthecve.com/cve/CVE-2024-52423.htmlhttps://patchthecve.com/cve/CVE-2024-52423.htmlWed, 17 Jun 2026 08:07:11 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Stored XSS.This issue affects Themify Builder: from n/a through <= 7.6.5.https://patchthecve.com/cve/CVE-2024-9385.htmlhttps://patchthecve.com/cve/CVE-2024-9385.htmlWed, 17 Jun 2026 08:24:27 +0000MEDIUM 6.1: The Themify Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.6.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages https://patchthecve.com/cve/CVE-2024-7836.htmlhttps://patchthecve.com/cve/CVE-2024-7836.htmlWed, 17 Jun 2026 08:21:00 +0000MEDIUM 4.3: The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate