https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-58192.htmlhttps://patchthecve.com/cve/CVE-2025-58192.htmlWed, 17 Jun 2026 09:44:02 +0000MEDIUM 4.3: Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.https://patchthecve.com/cve/CVE-2025-47453.htmlhttps://patchthecve.com/cve/CVE-2025-47453.htmlWed, 17 Jun 2026 09:28:08 +0000HIGH 8.1: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes WP Smart Import wp-smart-import allows PHP Local File Inclusion.This issue affects WP Smart Import: from n/a through <= 1.1.3.https://patchthecve.com/cve/CVE-2025-48256.htmlhttps://patchthecve.com/cve/CVE-2025-48256.htmlWed, 17 Jun 2026 09:29:21 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes Import Social Events import-facebook-events allows Stored XSS.This issue affects Import Social Events: from n/a through <= 1.8.5.https://patchthecve.com/cve/CVE-2025-47531.htmlhttps://patchthecve.com/cve/CVE-2025-47531.htmlWed, 17 Jun 2026 09:28:15 +0000HIGH 7.5: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through <= 1.1.7.https://patchthecve.com/cve/CVE-2025-24700.htmlhttps://patchthecve.com/cve/CVE-2025-24700.htmlWed, 17 Jun 2026 08:59:27 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator wp-event-aggregator allows Reflected XSS.This issue affects WP Event Aggregator: from n/a through <= 1.8.2.https://patchthecve.com/cve/CVE-2024-47352.htmlhttps://patchthecve.com/cve/CVE-2024-47352.htmlWed, 17 Jun 2026 07:56:55 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.3.1.https://patchthecve.com/cve/CVE-2024-38703.htmlhttps://patchthecve.com/cve/CVE-2024-38703.htmlWed, 17 Jun 2026 07:40:53 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.https://patchthecve.com/cve/CVE-2024-32597.htmlhttps://patchthecve.com/cve/CVE-2024-32597.htmlWed, 17 Jun 2026 07:29:55 +0000MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Stored XSS.This issue affects WordPress Importer: from n/a through 1.0.7.https://patchthecve.com/cve/CVE-2024-31371.htmlhttps://patchthecve.com/cve/CVE-2024-31371.htmlWed, 17 Jun 2026 07:28:18 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6.https://patchthecve.com/cve/CVE-2024-30201.htmlhttps://patchthecve.com/cve/CVE-2024-30201.htmlWed, 17 Jun 2026 07:26:28 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WordPress Importer allows Reflected XSS.This issue affects WordPress Importer: from n/a through 1.0.4.