PatchTheCVE: woody ad snippetshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-16289: The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winphttps://patchthecve.com/cve/CVE-2019-16289.htmlhttps://patchthecve.com/cve/CVE-2019-16289.htmlWed, 17 Jun 2026 02:22:04 +0000MEDIUM 5.4: The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.CVE-2019-15858: admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unhttps://patchthecve.com/cve/CVE-2019-15858.htmlhttps://patchthecve.com/cve/CVE-2019-15858.htmlWed, 17 Jun 2026 02:21:13 +0000HIGH 8.8: admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.CVE-2019-14773: admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows https://patchthecve.com/cve/CVE-2019-14773.htmlhttps://patchthecve.com/cve/CVE-2019-14773.htmlWed, 17 Jun 2026 02:18:59 +0000HIGH 7.5: admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.