https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-5638.htmlhttps://patchthecve.com/cve/CVE-2024-5638.htmlWed, 17 Jun 2026 08:16:20 +0000MEDIUM 6.1: The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible https://patchthecve.com/cve/CVE-2024-5613.htmlhttps://patchthecve.com/cve/CVE-2024-5613.htmlWed, 17 Jun 2026 08:16:17 +0000MEDIUM 6.1: The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauhttps://patchthecve.com/cve/CVE-2023-25166.htmlhttps://patchthecve.com/cve/CVE-2023-25166.htmlWed, 28 Oct 2026 19:10:00 +0000MEDIUM 5.5: formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.