https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-5419.htmlhttps://patchthecve.com/cve/CVE-2023-5419.htmlWed, 17 Jun 2026 06:48:33 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, tohttps://patchthecve.com/cve/CVE-2023-5417.htmlhttps://patchthecve.com/cve/CVE-2023-5417.htmlWed, 17 Jun 2026 06:48:33 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, https://patchthecve.com/cve/CVE-2023-5416.htmlhttps://patchthecve.com/cve/CVE-2023-5416.htmlWed, 17 Jun 2026 06:48:33 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, https://patchthecve.com/cve/CVE-2023-5415.htmlhttps://patchthecve.com/cve/CVE-2023-5415.htmlWed, 17 Jun 2026 06:48:32 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to https://patchthecve.com/cve/CVE-2023-5411.htmlhttps://patchthecve.com/cve/CVE-2023-5411.htmlWed, 17 Jun 2026 06:48:32 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, tohttps://patchthecve.com/cve/CVE-2023-5387.htmlhttps://patchthecve.com/cve/CVE-2023-5387.htmlWed, 17 Jun 2026 06:48:29 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and ahttps://patchthecve.com/cve/CVE-2023-5386.htmlhttps://patchthecve.com/cve/CVE-2023-5386.htmlWed, 17 Jun 2026 06:48:29 +0000MEDIUM 6.5: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to https://patchthecve.com/cve/CVE-2023-5385.htmlhttps://patchthecve.com/cve/CVE-2023-5385.htmlWed, 17 Jun 2026 06:48:29 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to crhttps://patchthecve.com/cve/CVE-2023-5383.htmlhttps://patchthecve.com/cve/CVE-2023-5383.htmlWed, 17 Jun 2026 06:48:28 +0000MEDIUM 4.3: The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_copy_posts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts https://patchthecve.com/cve/CVE-2023-5382.htmlhttps://patchthecve.com/cve/CVE-2023-5382.htmlWed, 17 Jun 2026 06:48:28 +0000MEDIUM 6.5: The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsf_delete_posts function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a fohttps://patchthecve.com/cve/CVE-2023-4950.htmlhttps://patchthecve.com/cve/CVE-2023-4950.htmlWed, 17 Jun 2026 06:38:58 +0000MEDIUM 6.1: The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks