https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22850.htmlhttps://patchthecve.com/cve/CVE-2026-22850.htmlWed, 17 Jun 2026 10:20:30 +0000HIGH 8.3: Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import. Unauthenticated visitors can submit arbitrary path (`pa`) and referrer (`r`) values to the pubhttps://patchthecve.com/cve/CVE-2024-9704.htmlhttps://patchthecve.com/cve/CVE-2024-9704.htmlWed, 17 Jun 2026 08:25:05 +0000MEDIUM 6.4: The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fhttps://patchthecve.com/cve/CVE-2024-8662.htmlhttps://patchthecve.com/cve/CVE-2024-8662.htmlWed, 17 Jun 2026 08:23:04 +0000MEDIUM 6.1: The Koko Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.12. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages https://patchthecve.com/cve/CVE-2024-8680.htmlhttps://patchthecve.com/cve/CVE-2024-8680.htmlWed, 17 Jun 2026 08:23:06 +0000MEDIUM 4.4: The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-levehttps://patchthecve.com/cve/CVE-2024-8850.htmlhttps://patchthecve.com/cve/CVE-2024-8850.htmlWed, 17 Jun 2026 08:23:25 +0000MEDIUM 6.1: The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible fohttps://patchthecve.com/cve/CVE-2023-51682.htmlhttps://patchthecve.com/cve/CVE-2023-51682.htmlWed, 17 Jun 2026 06:41:27 +0000MEDIUM 5.3: Missing Authorization vulnerability in ibericode MC4WP.This issue affects MC4WP: from n/a through 4.9.9.