https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12299.htmlhttps://patchthecve.com/cve/CVE-2024-12299.htmlWed, 17 Jun 2026 06:59:27 +0000MEDIUM 6.1: The System Dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Filename parameter in all versions up to, and including, 2.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web shttps://patchthecve.com/cve/CVE-2024-11107.htmlhttps://patchthecve.com/cve/CVE-2024-11107.htmlWed, 17 Jun 2026 06:57:04 +0000MEDIUM 6.1: The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.https://patchthecve.com/cve/CVE-2024-10708.htmlhttps://patchthecve.com/cve/CVE-2024-10708.htmlWed, 17 Jun 2026 06:56:14 +0000MEDIUM 4.9: The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the serverhttps://patchthecve.com/cve/CVE-2023-7246.htmlhttps://patchthecve.com/cve/CVE-2023-7246.htmlWed, 17 Jun 2026 06:52:24 +0000MEDIUM 5.4: The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks