https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-24782.htmlhttps://patchthecve.com/cve/CVE-2025-24782.htmlWed, 17 Jun 2026 08:59:35 +0000MEDIUM 6.5: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through https://patchthecve.com/cve/CVE-2024-13409.htmlhttps://patchthecve.com/cve/CVE-2024-13409.htmlWed, 17 Jun 2026 07:01:57 +0000HIGH 7.5: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenhttps://patchthecve.com/cve/CVE-2024-29925.htmlhttps://patchthecve.com/cve/CVE-2024-29925.htmlWed, 17 Jun 2026 07:23:22 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Post Grid, Slider & Carousel Ultimate allows Stored XSS.This issue affects Post Grid, Slider & Carousel Ultimate: from n/a through 1.6.6.https://patchthecve.com/cve/CVE-2024-2006.htmlhttps://patchthecve.com/cve/CVE-2024-2006.htmlWed, 17 Jun 2026 07:23:32 +0000HIGH 8.8: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it