https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-2221.htmlhttps://patchthecve.com/cve/CVE-2023-2221.htmlWed, 17 Jun 2026 05:52:02 +0000HIGH 7.2: The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.https://patchthecve.com/cve/CVE-2022-3151.htmlhttps://patchthecve.com/cve/CVE-2022-3151.htmlWed, 17 Jun 2026 04:58:57 +0000MEDIUM 4.3: The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack.https://patchthecve.com/cve/CVE-2022-3150.htmlhttps://patchthecve.com/cve/CVE-2022-3150.htmlWed, 17 Jun 2026 04:58:57 +0000HIGH 7.2: The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as adminhttps://patchthecve.com/cve/CVE-2022-3149.htmlhttps://patchthecve.com/cve/CVE-2022-3149.htmlWed, 17 Jun 2026 04:58:57 +0000MEDIUM 6.1: The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor option