https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-53939.htmlhttps://patchthecve.com/cve/CVE-2023-53939.htmlWed, 17 Jun 2026 06:46:22 +0000MEDIUM 5.4: TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the folder name parameter. Attackers can edit album folder names with script tags to execute arbitrary JavaScript when other users view the affected gallerhttps://patchthecve.com/cve/CVE-2023-53922.htmlhttps://patchthecve.com/cve/CVE-2023-53922.htmlWed, 17 Jun 2026 06:46:20 +0000CRITICAL 9.8: TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded fhttps://patchthecve.com/cve/CVE-2025-1440.htmlhttps://patchthecve.com/cve/CVE-2025-1440.htmlWed, 17 Jun 2026 08:39:08 +0000MEDIUM 5.3: The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up to, and including, 2024.5 due to insufficient restrictions. This makes it possible for unauthenticated attackers to update the advancediFramehttps://patchthecve.com/cve/CVE-2025-1439.htmlhttps://patchthecve.com/cve/CVE-2025-1439.htmlWed, 17 Jun 2026 08:39:08 +0000MEDIUM 6.4: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2024.5 due to insufficient input sanitization and output escaping on user supplied attributes through the 'src' attribute when the https://patchthecve.com/cve/CVE-2025-1437.htmlhttps://patchthecve.com/cve/CVE-2025-1437.htmlWed, 17 Jun 2026 08:39:08 +0000MEDIUM 6.4: The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2025.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic