https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-2869.htmlhttps://patchthecve.com/cve/CVE-2024-2869.htmlWed, 17 Jun 2026 07:25:43 +0000MEDIUM 4.8: The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)https://patchthecve.com/cve/CVE-2024-32799.htmlhttps://patchthecve.com/cve/CVE-2024-32799.htmlWed, 17 Jun 2026 07:30:27 +0000MEDIUM 5.3: Missing Authorization vulnerability in Merv Barrett Easy Property Listings.This issue affects Easy Property Listings: from n/a through 3.5.3.https://patchthecve.com/cve/CVE-2024-1893.htmlhttps://patchthecve.com/cve/CVE-2024-1893.htmlWed, 17 Jun 2026 07:05:14 +0000HIGH 8.8: The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query