https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-9769.htmlhttps://patchthecve.com/cve/CVE-2024-9769.htmlWed, 17 Jun 2026 08:25:13 +0000MEDIUM 4.4: The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with admhttps://patchthecve.com/cve/CVE-2024-10247.htmlhttps://patchthecve.com/cve/CVE-2024-10247.htmlWed, 17 Jun 2026 06:55:14 +0000HIGH 7.2: The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existinhttps://patchthecve.com/cve/CVE-2024-52430.htmlhttps://patchthecve.com/cve/CVE-2024-52430.htmlWed, 17 Jun 2026 08:07:12 +0000CRITICAL 9.8: Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.https://patchthecve.com/cve/CVE-2024-4551.htmlhttps://patchthecve.com/cve/CVE-2024-4551.htmlWed, 17 Jun 2026 08:02:07 +0000MEDIUM 6.4: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the display function. This makes it possible for authenticated attackers, with contributor access and higher, to include and exehttps://patchthecve.com/cve/CVE-2024-4258.htmlhttps://patchthecve.com/cve/CVE-2024-4258.htmlWed, 17 Jun 2026 08:01:32 +0000CRITICAL 9.8: The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the serve