https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-44587.htmlhttps://patchthecve.com/cve/CVE-2022-44587.htmlWed, 17 Jun 2026 05:08:34 +0000MEDIUM 5.3: Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.https://patchthecve.com/cve/CVE-2024-32568.htmlhttps://patchthecve.com/cve/CVE-2024-32568.htmlWed, 17 Jun 2026 07:29:52 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP 2FA wp-2fa.This issue affects WP 2FA: from n/a through <= 2.6.2.https://patchthecve.com/cve/CVE-2022-44595.htmlhttps://patchthecve.com/cve/CVE-2022-44595.htmlWed, 17 Jun 2026 05:08:35 +0000MEDIUM 5.3: Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.https://patchthecve.com/cve/CVE-2023-6520.htmlhttps://patchthecve.com/cve/CVE-2023-6520.htmlWed, 17 Jun 2026 06:50:54 +0000MEDIUM 4.3: The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on the send_backup_codes_email function. This makes it possible for unauthenticated https://patchthecve.com/cve/CVE-2023-6506.htmlhttps://patchthecve.com/cve/CVE-2023-6506.htmlWed, 17 Jun 2026 06:50:52 +0000MEDIUM 4.3: The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.5.0 via the send_backup_codes_email due to missing validation on a user controlled key. This makes it possible for subscriber-level atta