https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-10554.htmlhttps://patchthecve.com/cve/CVE-2024-10554.htmlWed, 17 Jun 2026 06:55:55 +0000LOW 3.5: The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite sethttps://patchthecve.com/cve/CVE-2024-13851.htmlhttps://patchthecve.com/cve/CVE-2024-13851.htmlWed, 17 Jun 2026 07:02:50 +0000MEDIUM 5.5: The Modal Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.7.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbhttps://patchthecve.com/cve/CVE-2024-9796.htmlhttps://patchthecve.com/cve/CVE-2024-9796.htmlWed, 17 Jun 2026 08:25:16 +0000CRITICAL 9.8: The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks