https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-47623.htmlhttps://patchthecve.com/cve/CVE-2025-47623.htmlWed, 17 Jun 2026 09:28:25 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Easy PayPal Buy Now Button wp-ecommerce-paypal allows Stored XSS.This issue affects Easy PayPal Buy Now Button: from n/a through <= 2.0.https://patchthecve.com/cve/CVE-2025-47517.htmlhttps://patchthecve.com/cve/CVE-2025-47517.htmlWed, 17 Jun 2026 09:28:14 +0000HIGH 7.1: Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Stored XSS.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.4.5.https://patchthecve.com/cve/CVE-2024-10685.htmlhttps://patchthecve.com/cve/CVE-2024-10685.htmlWed, 17 Jun 2026 06:56:11 +0000MEDIUM 6.1: The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inhttps://patchthecve.com/cve/CVE-2024-10683.htmlhttps://patchthecve.com/cve/CVE-2024-10683.htmlWed, 17 Jun 2026 06:56:11 +0000MEDIUM 6.1: The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3.1. This makes it possible for unauthenticated attackerhttps://patchthecve.com/cve/CVE-2024-50492.htmlhttps://patchthecve.com/cve/CVE-2024-50492.htmlMon, 21 Sep 2026 14:14:35 +0000HIGH 8.3: Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCart: from n/a through <= 1.1.https://patchthecve.com/cve/CVE-2024-9593.htmlhttps://patchthecve.com/cve/CVE-2024-9593.htmlWed, 17 Jun 2026 08:24:53 +0000HIGH 8.3: The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code https://patchthecve.com/cve/CVE-2024-8476.htmlhttps://patchthecve.com/cve/CVE-2024-8476.htmlWed, 17 Jun 2026 08:22:40 +0000MEDIUM 4.3: The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeevent_plugin_buttons() function. This makes it possible for unauthenticated attackers to delete arbitrarhttps://patchthecve.com/cve/CVE-2024-29130.htmlhttps://patchthecve.com/cve/CVE-2024-29130.htmlWed, 17 Jun 2026 07:22:28 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe Add-on: from n/a through 2.0.