PatchTheCVE: rockcontenthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-36428: Authhttps://patchthecve.com/cve/CVE-2022-36428.htmlhttps://patchthecve.com/cve/CVE-2022-36428.htmlWed, 17 Jun 2026 04:53:26 +0000MEDIUM 4.8: Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.CVE-2022-3441: The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which couldhttps://patchthecve.com/cve/CVE-2022-3441.htmlhttps://patchthecve.com/cve/CVE-2022-3441.htmlWed, 17 Jun 2026 04:59:32 +0000MEDIUM 4.8: The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2022-3440: The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back https://patchthecve.com/cve/CVE-2022-3440.htmlhttps://patchthecve.com/cve/CVE-2022-3440.htmlWed, 17 Jun 2026 04:59:31 +0000MEDIUM 6.1: The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting