https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-3644.htmlhttps://patchthecve.com/cve/CVE-2024-3644.htmlWed, 17 Jun 2026 07:44:43 +0000MEDIUM 4.8: The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)https://patchthecve.com/cve/CVE-2024-3643.htmlhttps://patchthecve.com/cve/CVE-2024-3643.htmlWed, 17 Jun 2026 07:44:43 +0000HIGH 8.8: The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attackhttps://patchthecve.com/cve/CVE-2024-3642.htmlhttps://patchthecve.com/cve/CVE-2024-3642.htmlWed, 17 Jun 2026 07:44:43 +0000MEDIUM 6.9: The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attackhttps://patchthecve.com/cve/CVE-2024-3641.htmlhttps://patchthecve.com/cve/CVE-2024-3641.htmlWed, 17 Jun 2026 07:44:42 +0000MEDIUM 6.1: The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins