https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-18598.htmlhttps://patchthecve.com/cve/CVE-2017-18598.htmlWed, 17 Jun 2026 01:13:10 +0000MEDIUM 6.1: The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.https://patchthecve.com/cve/CVE-2018-20156.htmlhttps://patchthecve.com/cve/CVE-2018-20156.htmlWed, 17 Jun 2026 01:52:21 +0000HIGH 7.2: The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network.https://patchthecve.com/cve/CVE-2018-20155.htmlhttps://patchthecve.com/cve/CVE-2018-20155.htmlWed, 17 Jun 2026 01:52:21 +0000MEDIUM 4.3: The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.https://patchthecve.com/cve/CVE-2018-20154.htmlhttps://patchthecve.com/cve/CVE-2018-20154.htmlWed, 17 Jun 2026 01:52:21 +0000MEDIUM 4.3: The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.