PatchTheCVE: linksoftwarellchttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-46236: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Sofhttps://patchthecve.com/cve/CVE-2025-46236.htmlhttps://patchthecve.com/cve/CVE-2025-46236.htmlWed, 17 Jun 2026 09:26:04 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.CVE-2024-6412: The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow atthttps://patchthecve.com/cve/CVE-2024-6412.htmlhttps://patchthecve.com/cve/CVE-2024-6412.htmlWed, 17 Jun 2026 08:17:57 +0000MEDIUM 6.5: The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacksCVE-2024-6243: The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing https://patchthecve.com/cve/CVE-2024-6243.htmlhttps://patchthecve.com/cve/CVE-2024-6243.htmlWed, 17 Jun 2026 08:17:36 +0000MEDIUM 4.8: The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.