https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-6708.htmlhttps://patchthecve.com/cve/CVE-2024-6708.htmlWed, 17 Jun 2026 08:18:31 +0000MEDIUM 4.8: The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.https://patchthecve.com/cve/CVE-2024-12919.htmlhttps://patchthecve.com/cve/CVE-2024-12919.htmlWed, 17 Jun 2026 07:00:45 +0000CRITICAL 9.8: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supphttps://patchthecve.com/cve/CVE-2024-11291.htmlhttps://patchthecve.com/cve/CVE-2024-11291.htmlWed, 17 Jun 2026 06:57:28 +0000MEDIUM 5.3: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated atthttps://patchthecve.com/cve/CVE-2024-10261.htmlhttps://patchthecve.com/cve/CVE-2024-10261.htmlWed, 17 Jun 2026 06:55:15 +0000HIGH 7.3: The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not prohttps://patchthecve.com/cve/CVE-2024-6695.htmlhttps://patchthecve.com/cve/CVE-2024-6695.htmlWed, 17 Jun 2026 08:18:29 +0000CRITICAL 9.8: it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.https://patchthecve.com/cve/CVE-2024-6366.htmlhttps://patchthecve.com/cve/CVE-2024-6366.htmlWed, 17 Jun 2026 08:17:51 +0000CRITICAL 9.1: The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.https://patchthecve.com/cve/CVE-2024-5639.htmlhttps://patchthecve.com/cve/CVE-2024-5639.htmlWed, 17 Jun 2026 08:16:20 +0000MEDIUM 4.3: The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Auhttps://patchthecve.com/cve/CVE-2023-51522.htmlhttps://patchthecve.com/cve/CVE-2023-51522.htmlWed, 17 Jun 2026 06:41:07 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.https://patchthecve.com/cve/CVE-2024-1390.htmlhttps://patchthecve.com/cve/CVE-2024-1390.htmlWed, 17 Jun 2026 07:04:07 +0000MEDIUM 4.3: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. Thihttps://patchthecve.com/cve/CVE-2024-1389.htmlhttps://patchthecve.com/cve/CVE-2024-1389.htmlWed, 17 Jun 2026 07:04:07 +0000MEDIUM 5.3: The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and inchttps://patchthecve.com/cve/CVE-2024-22140.htmlhttps://patchthecve.com/cve/CVE-2024-22140.htmlWed, 17 Jun 2026 07:10:48 +0000HIGH 8.8: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.https://patchthecve.com/cve/CVE-2024-22141.htmlhttps://patchthecve.com/cve/CVE-2024-22141.htmlWed, 17 Jun 2026 07:10:48 +0000MEDIUM 6.5: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.https://patchthecve.com/cve/CVE-2024-22142.htmlhttps://patchthecve.com/cve/CVE-2024-22142.htmlWed, 17 Jun 2026 07:10:49 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.https://patchthecve.com/cve/CVE-2023-6504.htmlhttps://patchthecve.com/cve/CVE-2023-6504.htmlWed, 17 Jun 2026 06:50:52 +0000MEDIUM 4.3: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it