https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-1016.htmlhttps://patchthecve.com/cve/CVE-2023-1016.htmlWed, 17 Jun 2026 05:26:53 +0000MEDIUM 6.6: The Intuitive Custom Post Order plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.1.4.1, due to insufficient escaping on the user supplied 'objects' and 'tags' parameters and lack of sufficient preparation in the 'update_options' function as well as the 'refreshhttps://patchthecve.com/cve/CVE-2022-4386.htmlhttps://patchthecve.com/cve/CVE-2022-4386.htmlWed, 17 Jun 2026 05:20:45 +0000MEDIUM 4.3: The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attackhttps://patchthecve.com/cve/CVE-2022-4385.htmlhttps://patchthecve.com/cve/CVE-2022-4385.htmlWed, 17 Jun 2026 05:20:45 +0000MEDIUM 4.3: The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order