https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-2800.htmlhttps://patchthecve.com/cve/CVE-2025-2800.htmlWed, 17 Jun 2026 09:07:38 +0000HIGH 7.2: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makehttps://patchthecve.com/cve/CVE-2025-2799.htmlhttps://patchthecve.com/cve/CVE-2025-2799.htmlWed, 17 Jun 2026 09:07:38 +0000MEDIUM 4.4: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitization and output escaping. This makes it phttps://patchthecve.com/cve/CVE-2024-2691.htmlhttps://patchthecve.com/cve/CVE-2024-2691.htmlWed, 17 Jun 2026 07:25:04 +0000MEDIUM 6.4: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user shttps://patchthecve.com/cve/CVE-2024-0976.htmlhttps://patchthecve.com/cve/CVE-2024-0976.htmlWed, 17 Jun 2026 06:54:41 +0000MEDIUM 6.1: The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it pohttps://patchthecve.com/cve/CVE-2023-52118.htmlhttps://patchthecve.com/cve/CVE-2023-52118.htmlWed, 17 Jun 2026 06:42:07 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.https://patchthecve.com/cve/CVE-2023-6384.htmlhttps://patchthecve.com/cve/CVE-2023-6384.htmlWed, 17 Jun 2026 06:50:39 +0000MEDIUM 4.3: The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar