PatchTheCVE: spiffypluginshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-49695: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Phttps://patchthecve.com/cve/CVE-2024-49695.htmlhttps://patchthecve.com/cve/CVE-2024-49695.htmlWed, 17 Jun 2026 08:00:17 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.3.CVE-2024-45458: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Phttps://patchthecve.com/cve/CVE-2024-45458.htmlhttps://patchthecve.com/cve/CVE-2024-45458.htmlWed, 17 Jun 2026 07:54:14 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.CVE-2024-45457: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Phttps://patchthecve.com/cve/CVE-2024-45457.htmlhttps://patchthecve.com/cve/CVE-2024-45457.htmlWed, 17 Jun 2026 07:54:14 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Stored XSS.This issue affects Spiffy Calendar: from n/a through <= 4.9.13.CVE-2024-38692: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Phttps://patchthecve.com/cve/CVE-2024-38692.htmlhttps://patchthecve.com/cve/CVE-2024-38692.htmlWed, 17 Jun 2026 07:40:52 +0000HIGH 7.6: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.