https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-8046.htmlhttps://patchthecve.com/cve/CVE-2025-8046.htmlWed, 17 Jun 2026 10:06:12 +0000MEDIUM 6.1: The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsershttps://patchthecve.com/cve/CVE-2025-7808.htmlhttps://patchthecve.com/cve/CVE-2025-7808.htmlWed, 17 Jun 2026 10:05:42 +0000MEDIUM 6.1: The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminhttps://patchthecve.com/cve/CVE-2024-9835.htmlhttps://patchthecve.com/cve/CVE-2024-9835.htmlWed, 17 Jun 2026 08:25:21 +0000MEDIUM 4.8: The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsershttps://patchthecve.com/cve/CVE-2024-10057.htmlhttps://patchthecve.com/cve/CVE-2024-10057.htmlWed, 17 Jun 2026 06:54:50 +0000MEDIUM 6.4: The RSS Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rfw-youtube-videos shortcode in all versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentichttps://patchthecve.com/cve/CVE-2024-35695.htmlhttps://patchthecve.com/cve/CVE-2024-35695.htmlWed, 17 Jun 2026 07:35:12 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs allows Stored XSS.This issue affects WP Docs: from n/a through 2.1.3.