https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5275.htmlhttps://patchthecve.com/cve/CVE-2025-5275.htmlWed, 17 Jun 2026 09:47:35 +0000MEDIUM 4.4: The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. Thihttps://patchthecve.com/cve/CVE-2025-4577.htmlhttps://patchthecve.com/cve/CVE-2025-4577.htmlWed, 17 Jun 2026 09:33:33 +0000MEDIUM 6.4: The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authttps://patchthecve.com/cve/CVE-2024-10878.htmlhttps://patchthecve.com/cve/CVE-2024-10878.htmlWed, 17 Jun 2026 06:56:37 +0000MEDIUM 6.1: The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackehttps://patchthecve.com/cve/CVE-2024-10045.htmlhttps://patchthecve.com/cve/CVE-2024-10045.htmlWed, 17 Jun 2026 06:54:49 +0000MEDIUM 4.3: The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the process_actions function. This makes it possible for unauthenticated attackers to delete transients via a f