https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-4019.htmlhttps://patchthecve.com/cve/CVE-2023-4019.htmlWed, 17 Jun 2026 06:36:55 +0000HIGH 8.8: The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.https://patchthecve.com/cve/CVE-2023-4036.htmlhttps://patchthecve.com/cve/CVE-2023-4036.htmlWed, 17 Jun 2026 06:36:57 +0000MEDIUM 4.3: The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authenticated users, such as subscriber, to retrieve arbitrary post title and their content such as draft, private and password protected oneshttps://patchthecve.com/cve/CVE-2023-4035.htmlhttps://patchthecve.com/cve/CVE-2023-4035.htmlWed, 17 Jun 2026 06:36:57 +0000MEDIUM 5.4: The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attackshttps://patchthecve.com/cve/CVE-2023-4023.htmlhttps://patchthecve.com/cve/CVE-2023-4023.htmlWed, 17 Jun 2026 06:36:56 +0000MEDIUM 4.3: The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.