https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-49685.htmlhttps://patchthecve.com/cve/CVE-2024-49685.htmlWed, 17 Jun 2026 08:00:16 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Custom Twitter Feeds (Tweets Widget) custom-twitter-feeds allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through <= 2.2.3.https://patchthecve.com/cve/CVE-2024-8983.htmlhttps://patchthecve.com/cve/CVE-2024-8983.htmlWed, 17 Jun 2026 08:23:41 +0000MEDIUM 4.8: Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).https://patchthecve.com/cve/CVE-2024-8200.htmlhttps://patchthecve.com/cve/CVE-2024-8200.htmlWed, 17 Jun 2026 08:22:06 +0000MEDIUM 4.3: The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the 'update_api_key' functiohttps://patchthecve.com/cve/CVE-2024-8199.htmlhttps://patchthecve.com/cve/CVE-2024-8199.htmlWed, 17 Jun 2026 08:22:06 +0000MEDIUM 4.3: The Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_api_key' function in all versions up to, and including, 1.1.2. This makeshttps://patchthecve.com/cve/CVE-2024-6256.htmlhttps://patchthecve.com/cve/CVE-2024-6256.htmlWed, 17 Jun 2026 08:17:38 +0000MEDIUM 6.4: The Feeds for YouTube (YouTube video, channel, and gallery plugin) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'youtube-feed' shortcode in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping on user supplied attrihttps://patchthecve.com/cve/CVE-2024-0379.htmlhttps://patchthecve.com/cve/CVE-2024-0379.htmlWed, 17 Jun 2026 06:53:22 +0000MEDIUM 4.3: The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthentica