https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-1376.htmlhttps://patchthecve.com/cve/CVE-2015-1376.htmlWed, 17 Jun 2026 00:22:17 +0000MEDIUM 4.0: pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.https://patchthecve.com/cve/CVE-2015-1375.htmlhttps://patchthecve.com/cve/CVE-2015-1375.htmlWed, 17 Jun 2026 00:22:17 +0000HIGH 7.5: pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.https://patchthecve.com/cve/CVE-2015-1366.htmlhttps://patchthecve.com/cve/CVE-2015-1366.htmlWed, 17 Jun 2026 00:22:16 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.https://patchthecve.com/cve/CVE-2015-1365.htmlhttps://patchthecve.com/cve/CVE-2015-1365.htmlWed, 17 Jun 2026 00:22:16 +0000MEDIUM 5.0: Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.