https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-24342.htmlhttps://patchthecve.com/cve/CVE-2021-24342.htmlWed, 17 Jun 2026 03:39:51 +0000MEDIUM 6.1: The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.https://patchthecve.com/cve/CVE-2015-7342.htmlhttps://patchthecve.com/cve/CVE-2015-7342.htmlWed, 17 Jun 2026 00:32:17 +0000HIGH 7.2: JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.https://patchthecve.com/cve/CVE-2015-7341.htmlhttps://patchthecve.com/cve/CVE-2015-7341.htmlWed, 17 Jun 2026 00:32:17 +0000HIGH 8.8: JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension.https://patchthecve.com/cve/CVE-2015-7343.htmlhttps://patchthecve.com/cve/CVE-2015-7343.htmlWed, 17 Jun 2026 00:32:17 +0000MEDIUM 4.8: JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.