https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-2942.htmlhttps://patchthecve.com/cve/CVE-2025-2942.htmlWed, 17 Jun 2026 09:07:53 +0000MEDIUM 4.3: The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title (such as from draft and private posts) via an unauthenticated AJAX action, allowing attackers to retrieve such informationhttps://patchthecve.com/cve/CVE-2025-2907.htmlhttps://patchthecve.com/cve/CVE-2025-2907.htmlWed, 17 Jun 2026 09:07:49 +0000CRITICAL 9.8: The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify https://patchthecve.com/cve/CVE-2024-13359.htmlhttps://patchthecve.com/cve/CVE-2024-13359.htmlWed, 17 Jun 2026 07:01:51 +0000HIGH 8.1: The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may make it possible for unauthenticated atthttps://patchthecve.com/cve/CVE-2024-56242.htmlhttps://patchthecve.com/cve/CVE-2024-56242.htmlWed, 17 Jun 2026 08:11:54 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.14.https://patchthecve.com/cve/CVE-2022-46795.htmlhttps://patchthecve.com/cve/CVE-2022-46795.htmlWed, 17 Jun 2026 05:12:23 +0000MEDIUM 6.5: Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.7.2.https://patchthecve.com/cve/CVE-2024-10857.htmlhttps://patchthecve.com/cve/CVE-2024-10857.htmlWed, 17 Jun 2026 06:56:34 +0000MEDIUM 6.5: The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributorhttps://patchthecve.com/cve/CVE-2024-38783.htmlhttps://patchthecve.com/cve/CVE-2024-38783.htmlWed, 17 Jun 2026 07:41:03 +0000MEDIUM 5.3: Missing Authorization vulnerability in Tyche Softwares Arconix FAQ allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix FAQ: from n/a through 1.9.4.https://patchthecve.com/cve/CVE-2024-38769.htmlhttps://patchthecve.com/cve/CVE-2024-38769.htmlWed, 17 Jun 2026 07:41:01 +0000MEDIUM 5.3: Missing Authorization vulnerability in Tyche Softwares Arconix Shortcodes allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Arconix Shortcodes: from n/a through 2.1.11.https://patchthecve.com/cve/CVE-2024-10226.htmlhttps://patchthecve.com/cve/CVE-2024-10226.htmlWed, 17 Jun 2026 06:55:11 +0000MEDIUM 6.4: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attahttps://patchthecve.com/cve/CVE-2024-9703.htmlhttps://patchthecve.com/cve/CVE-2024-9703.htmlWed, 17 Jun 2026 08:25:05 +0000MEDIUM 6.4: The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated ahttps://patchthecve.com/cve/CVE-2024-9345.htmlhttps://patchthecve.com/cve/CVE-2024-9345.htmlWed, 17 Jun 2026 08:24:23 +0000MEDIUM 6.1: The Product Delivery Date for WooCommerce – Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to inject ar