https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-41750.htmlhttps://patchthecve.com/cve/CVE-2021-41750.htmlWed, 17 Jun 2026 04:08:52 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName https://patchthecve.com/cve/CVE-2021-41749.htmlhttps://patchthecve.com/cve/CVE-2021-41749.htmlWed, 17 Jun 2026 04:08:51 +0000CRITICAL 9.8: In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.https://patchthecve.com/cve/CVE-2021-44618.htmlhttps://patchthecve.com/cve/CVE-2021-44618.htmlWed, 17 Jun 2026 04:12:36 +0000CRITICAL 9.8: A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.https://patchthecve.com/cve/CVE-2020-12790.htmlhttps://patchthecve.com/cve/CVE-2020-12790.htmlWed, 17 Jun 2026 02:52:19 +0000HIGH 7.5: In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.