https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-4936.htmlhttps://patchthecve.com/cve/CVE-2024-4936.htmlWed, 17 Jun 2026 08:03:14 +0000CRITICAL 9.8: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allow_url_include to be https://patchthecve.com/cve/CVE-2024-25096.htmlhttps://patchthecve.com/cve/CVE-2024-25096.htmlWed, 17 Jun 2026 07:15:30 +0000CRITICAL 10.0: Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7.https://patchthecve.com/cve/CVE-2023-3452.htmlhttps://patchthecve.com/cve/CVE-2023-3452.htmlWed, 17 Jun 2026 06:14:06 +0000CRITICAL 9.8: The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclu