PatchTheCVE: topdigitaltrendshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2023-0280: The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its blhttps://patchthecve.com/cve/CVE-2023-0280.htmlhttps://patchthecve.com/cve/CVE-2023-0280.htmlWed, 17 Jun 2026 05:25:11 +0000MEDIUM 5.4: The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.CVE-2023-0268: The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of ihttps://patchthecve.com/cve/CVE-2023-0268.htmlhttps://patchthecve.com/cve/CVE-2023-0268.htmlWed, 17 Jun 2026 05:25:10 +0000MEDIUM 5.4: The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site ScriCVE-2023-0267: The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape somehttps://patchthecve.com/cve/CVE-2023-0267.htmlhttps://patchthecve.com/cve/CVE-2023-0267.htmlWed, 17 Jun 2026 05:25:09 +0000MEDIUM 5.4: The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-SiteCVE-2022-4501: The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check ohttps://patchthecve.com/cve/CVE-2022-4501.htmlhttps://patchthecve.com/cve/CVE-2022-4501.htmlWed, 17 Jun 2026 05:21:03 +0000HIGH 7.1: The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin'sCVE-2022-36798: Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plughttps://patchthecve.com/cve/CVE-2022-36798.htmlhttps://patchthecve.com/cve/CVE-2022-36798.htmlWed, 17 Jun 2026 04:53:59 +0000MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress.