https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-2203.htmlhttps://patchthecve.com/cve/CVE-2025-2203.htmlWed, 17 Jun 2026 09:06:31 +0000MEDIUM 6.1: The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attackshttps://patchthecve.com/cve/CVE-2024-1056.htmlhttps://patchthecve.com/cve/CVE-2024-1056.htmlWed, 17 Jun 2026 07:03:20 +0000MEDIUM 6.4: The FunnelKit Funnel Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allow_iframe_tag_in_post' function which uses the 'wp_kses_allowed_html' filter to globally allow script and iframe tags in posts in all versions up to, and including, 3.4.5. This makes it poshttps://patchthecve.com/cve/CVE-2024-6836.htmlhttps://patchthecve.com/cve/CVE-2024-6836.htmlWed, 17 Jun 2026 08:18:48 +0000MEDIUM 4.3: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple functions in all versions up to, and incluhttps://patchthecve.com/cve/CVE-2024-5192.htmlhttps://patchthecve.com/cve/CVE-2024-5192.htmlWed, 17 Jun 2026 08:15:22 +0000MEDIUM 6.4: The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mimes’ parameter in all versions up to, and including, 3.3.1 due to insufficient inpu