https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-8658.htmlhttps://patchthecve.com/cve/CVE-2020-8658.htmlWed, 17 Jun 2026 03:26:43 +0000HIGH 8.8: The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. Inhttps://patchthecve.com/cve/CVE-2017-18496.htmlhttps://patchthecve.com/cve/CVE-2017-18496.htmlWed, 17 Jun 2026 01:12:58 +0000MEDIUM 6.1: The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.https://patchthecve.com/cve/CVE-2015-3349.htmlhttps://patchthecve.com/cve/CVE-2015-3349.htmlWed, 17 Jun 2026 00:25:47 +0000MEDIUM 6.8: Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) deploy or (2) delete an .htaccess file via unspecified vectors.