https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-6938.htmlhttps://patchthecve.com/cve/CVE-2023-6938.htmlWed, 17 Jun 2026 06:51:43 +0000MEDIUM 6.4: The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, thttps://patchthecve.com/cve/CVE-2022-46841.htmlhttps://patchthecve.com/cve/CVE-2022-46841.htmlWed, 17 Jun 2026 05:12:30 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.https://patchthecve.com/cve/CVE-2008-2816.htmlhttps://patchthecve.com/cve/CVE-2008-2816.htmlTue, 16 Jun 2026 22:54:32 +0000HIGH 7.5: SQL injection vulnerability in post.php in Oxygen (aka O2PHP Bulletin Board) 2.0 allows remote attackers to execute arbitrary SQL commands via the repquote parameter in a reply action, a different vector than CVE-2006-1572.https://patchthecve.com/cve/CVE-2006-6280.htmlhttps://patchthecve.com/cve/CVE-2006-6280.htmlTue, 16 Jun 2026 22:32:50 +0000HIGH 7.5: SQL injection vulnerability in viewthread.php in Oxygen (O2PHP Bulletin Board) 1.1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter, a different vector than CVE-2006-1572.https://patchthecve.com/cve/CVE-2006-1572.htmlhttps://patchthecve.com/cve/CVE-2006-1572.htmlTue, 16 Jun 2026 22:23:13 +0000MEDIUM 5.0: SQL injection vulnerability in post.php in Oxygen 1.1.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a newthread action.