PatchTheCVE: hermit projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-29413: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 pluginhttps://patchthecve.com/cve/CVE-2022-29413.htmlhttps://patchthecve.com/cve/CVE-2022-29413.htmlWed, 17 Jun 2026 04:40:07 +0000MEDIUM 4.7: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter.CVE-2022-29412: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow https://patchthecve.com/cve/CVE-2022-29412.htmlhttps://patchthecve.com/cve/CVE-2022-29412.htmlWed, 17 Jun 2026 04:40:07 +0000MEDIUM 5.4: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, create source.CVE-2022-29411: SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to ehttps://patchthecve.com/cve/CVE-2022-29411.htmlhttps://patchthecve.com/cve/CVE-2022-29411.htmlWed, 17 Jun 2026 04:40:07 +0000HIGH 8.3: SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id).CVE-2022-29410: Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows https://patchthecve.com/cve/CVE-2022-29410.htmlhttps://patchthecve.com/cve/CVE-2022-29410.htmlWed, 17 Jun 2026 04:40:07 +0000HIGH 7.4: Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to execute SQLi attack via (&ids).