https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-3123.htmlhttps://patchthecve.com/cve/CVE-2025-3123.htmlWed, 17 Jun 2026 09:19:13 +0000MEDIUM 4.7: A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The explhttps://patchthecve.com/cve/CVE-2024-41305.htmlhttps://patchthecve.com/cve/CVE-2024-41305.htmlWed, 17 Jun 2026 07:47:33 +0000MEDIUM 4.7: A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.https://patchthecve.com/cve/CVE-2024-41304.htmlhttps://patchthecve.com/cve/CVE-2024-41304.htmlWed, 17 Jun 2026 07:47:33 +0000MEDIUM 5.4: An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file.https://patchthecve.com/cve/CVE-2024-32746.htmlhttps://patchthecve.com/cve/CVE-2024-32746.htmlWed, 17 Jun 2026 07:30:21 +0000MEDIUM 4.6: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module.https://patchthecve.com/cve/CVE-2024-32745.htmlhttps://patchthecve.com/cve/CVE-2024-32745.htmlWed, 17 Jun 2026 07:30:21 +0000MEDIUM 5.9: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under the CURRENT PAGE module.https://patchthecve.com/cve/CVE-2024-32744.htmlhttps://patchthecve.com/cve/CVE-2024-32744.htmlWed, 17 Jun 2026 07:30:21 +0000MEDIUM 4.6: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module.https://patchthecve.com/cve/CVE-2024-32743.htmlhttps://patchthecve.com/cve/CVE-2024-32743.htmlWed, 17 Jun 2026 07:30:21 +0000MEDIUM 5.5: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module.https://patchthecve.com/cve/CVE-2024-32341.htmlhttps://patchthecve.com/cve/CVE-2024-32341.htmlWed, 17 Jun 2026 07:29:32 +0000MEDIUM 5.4: Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters.https://patchthecve.com/cve/CVE-2024-32340.htmlhttps://patchthecve.com/cve/CVE-2024-32340.htmlWed, 17 Jun 2026 07:29:32 +0000CRITICAL 9.6: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.https://patchthecve.com/cve/CVE-2024-32339.htmlhttps://patchthecve.com/cve/CVE-2024-32339.htmlWed, 17 Jun 2026 07:29:31 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters.https://patchthecve.com/cve/CVE-2024-32338.htmlhttps://patchthecve.com/cve/CVE-2024-32338.htmlWed, 17 Jun 2026 07:29:31 +0000MEDIUM 5.4: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE TITLE parameter under the Current Page module.https://patchthecve.com/cve/CVE-2024-32337.htmlhttps://patchthecve.com/cve/CVE-2024-32337.htmlWed, 17 Jun 2026 07:29:31 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under the Security module.https://patchthecve.com/cve/CVE-2024-27563.htmlhttps://patchthecve.com/cve/CVE-2024-27563.htmlWed, 17 Jun 2026 07:20:01 +0000MEDIUM 5.3: A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter.https://patchthecve.com/cve/CVE-2024-27561.htmlhttps://patchthecve.com/cve/CVE-2024-27561.htmlWed, 17 Jun 2026 07:20:00 +0000HIGH 8.1: A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the installThemePlugin parameter.https://patchthecve.com/cve/CVE-2023-41425.htmlhttps://patchthecve.com/cve/CVE-2023-41425.htmlThu, 09 Jul 2026 01:18:38 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.