https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-3673.htmlhttps://patchthecve.com/cve/CVE-2024-3673.htmlWed, 17 Jun 2026 07:44:47 +0000CRITICAL 9.1: The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.https://patchthecve.com/cve/CVE-2024-3669.htmlhttps://patchthecve.com/cve/CVE-2024-3669.htmlWed, 17 Jun 2026 07:44:46 +0000MEDIUM 6.8: The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as adminhttps://patchthecve.com/cve/CVE-2024-3552.htmlhttps://patchthecve.com/cve/CVE-2024-3552.htmlWed, 17 Jun 2026 07:44:30 +0000CRITICAL 9.8: The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.