https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-0719.htmlhttps://patchthecve.com/cve/CVE-2024-0719.htmlWed, 17 Jun 2026 06:54:06 +0000MEDIUM 5.4: The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attackhttps://patchthecve.com/cve/CVE-2024-0711.htmlhttps://patchthecve.com/cve/CVE-2024-0711.htmlWed, 17 Jun 2026 06:54:04 +0000MEDIUM 6.1: The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting atthttps://patchthecve.com/cve/CVE-2024-24930.htmlhttps://patchthecve.com/cve/CVE-2024-24930.htmlWed, 17 Jun 2026 07:15:14 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes.Com Buttons Shortcode and Widget allows Stored XSS.This issue affects Buttons Shortcode and Widget: from n/a through 1.16.https://patchthecve.com/cve/CVE-2023-45102.htmlhttps://patchthecve.com/cve/CVE-2023-45102.htmlWed, 17 Jun 2026 06:28:14 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <= 1.20 versions.