https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-13642.htmlhttps://patchthecve.com/cve/CVE-2024-13642.htmlWed, 17 Jun 2026 07:02:26 +0000MEDIUM 6.4: The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authehttps://patchthecve.com/cve/CVE-2024-10872.htmlhttps://patchthecve.com/cve/CVE-2024-10872.htmlWed, 17 Jun 2026 06:56:36 +0000MEDIUM 6.4: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, withhttps://patchthecve.com/cve/CVE-2020-36840.htmlhttps://patchthecve.com/cve/CVE-2020-36840.htmlWed, 17 Jun 2026 03:16:18 +0000HIGH 7.3: The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackershttps://patchthecve.com/cve/CVE-2024-6491.htmlhttps://patchthecve.com/cve/CVE-2024-6491.htmlWed, 17 Jun 2026 08:18:06 +0000MEDIUM 4.3: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level achttps://patchthecve.com/cve/CVE-2024-6489.htmlhttps://patchthecve.com/cve/CVE-2024-6489.htmlWed, 17 Jun 2026 08:18:06 +0000MEDIUM 5.3: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access ahttps://patchthecve.com/cve/CVE-2024-3588.htmlhttps://patchthecve.com/cve/CVE-2024-3588.htmlWed, 17 Jun 2026 07:44:34 +0000MEDIUM 6.4: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticatehttps://patchthecve.com/cve/CVE-2024-1948.htmlhttps://patchthecve.com/cve/CVE-2024-1948.htmlWed, 17 Jun 2026 07:05:28 +0000MEDIUM 6.4: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access anhttps://patchthecve.com/cve/CVE-2023-6042.htmlhttps://patchthecve.com/cve/CVE-2023-6042.htmlWed, 17 Jun 2026 06:49:55 +0000HIGH 7.5: Any unauthenticated user may send e-mail from the site with any title or content to the adminhttps://patchthecve.com/cve/CVE-2023-5991.htmlhttps://patchthecve.com/cve/CVE-2023-5991.htmlWed, 17 Jun 2026 06:49:48 +0000CRITICAL 9.8: The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the serverhttps://patchthecve.com/cve/CVE-2023-48756.htmlhttps://patchthecve.com/cve/CVE-2023-48756.htmlWed, 17 Jun 2026 06:34:54 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.This issue affects JetBlocks For Elementor: from n/a through 1.3.8.https://patchthecve.com/cve/CVE-2023-28498.htmlhttps://patchthecve.com/cve/CVE-2023-28498.htmlWed, 17 Jun 2026 05:47:52 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.