# CVEs published 2024-03-13

221 CVEs were published on March 13, 2024: 11 critical, 49 high. Days are UTC.

- [CVE-2024-28251](https://cve.now/CVE-2024-28251.md): Cross-site websocket hijacking in Querybook (CVSS 5.6, pinterest querybook)
- [CVE-2024-2242](https://cve.now/CVE-2024-2242.md): Contact Form 7 \<= 5.9 - Reflected Cross-Site Scripting (CVSS 6.1, rocklobsterinc Contact Form)
- [CVE-2024-2079](https://cve.now/CVE-2024-2079.md): WPBakery Page Builder Addons by Livemesh \<= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, WPBakery Page Builder Addons by Livemesh)
- [CVE-2020-11862](https://cve.now/CVE-2020-11862.md): Insecure renegotiation in SSL protocol caused Denial of service attack in Privileged Account Manager (CVSS 8.6, OpenText NetIQ Privileged Account Manager)
- [CVE-2023-38536](https://cve.now/CVE-2023-38536.md): HTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1. (CVSS 6.4, OpenText™ Exceed Turbo X)
- [CVE-2023-38535](https://cve.now/CVE-2023-38535.md): Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. (CVSS 4.7, OpenText™ Exceed Turbo X)
- [CVE-2023-38534](https://cve.now/CVE-2023-38534.md): Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1. (CVSS 8.6, OpenText™ Exceed Turbo X)
- [CVE-2023-50726](https://cve.now/CVE-2023-50726.md): Users with \`create\` but not \`override\` privileges can perform local sync in argo-cd (CVSS 6.4, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-28175](https://cve.now/CVE-2024-28175.md): Cross-site scripting on application summary component in argo-cd (CVSS 9.1, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-22167](https://cve.now/CVE-2024-22167.md): SanDisk PrivateAccess DLL Hijacking Vulnerability (CVSS 7.9, SanDisk PrivateAccess Windows App)
- [CVE-2024-27097](https://cve.now/CVE-2024-27097.md): Potential log injection in reset user endpoint in ckan (CVSS 4.3, ckan)
- [CVE-2024-27102](https://cve.now/CVE-2024-27102.md): Improper isolation of server file access in github.com/pterodactyl/wings (CVSS 10.0, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2024-28193](https://cve.now/CVE-2024-28193.md): Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your\_spotify (CVSS 6.5, Yooooomi your\_spotify)
- [CVE-2024-28192](https://cve.now/CVE-2024-28192.md): NoSQL Injection Leading to Authentication Bypass in your\_spotify (CVSS 5.3, Yooooomi your\_spotify)
- [CVE-2024-24693](https://cve.now/CVE-2024-24693.md): Zoom Rooms Client for Windows - Improper Access Control (CVSS 7.2, Zoom Video Communications Zoom Rooms Client for Windows)
- [CVE-2024-24692](https://cve.now/CVE-2024-24692.md): Zoom Rooms Client for Windows - Race Condition (CVSS 5.3, Zoom Video Communications Zoom Rooms Client for Windows)
- [CVE-2024-0801](https://cve.now/CVE-2024-0801.md): Unauthenticated DoS in Arcserve Unified Data Protection (CVSS 7.5, Arcserve Unified Data Protection)
- [CVE-2024-0800](https://cve.now/CVE-2024-0800.md): Authentication Bypass via wizardLogin in Arcserve Unified Data Protection (CVSS 8.8, Arcserve Unified Data Protection)
- [CVE-2024-0799](https://cve.now/CVE-2024-0799.md): Authentication Bypass via wizardLogin in Arcserve Unified Data Protection (CVSS 9.8, Arcserve Unified Data Protection)
- [CVE-2024-28194](https://cve.now/CVE-2024-28194.md): Authentication Bypass Because of Hardcoded JWT Secret in your\_spotify (CVSS 9.1, Yooooomi your\_spotify)
- [CVE-2024-2403](https://cve.now/CVE-2024-2403.md): Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an atta (CVSS 5.9, Devolutions Remote Desktop Manager)
- [CVE-2024-2418](https://cve.now/CVE-2024-2418.md): SourceCodester Best POS Management System view\_order.php sql injection (CVSS 6.3, SourceCodester Best POS Management System)
- [CVE-2024-2433](https://cve.now/CVE-2024-2433.md): PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss (CVSS 4.3, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-2432](https://cve.now/CVE-2024-2432.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 4.5, Palo Alto Networks GlobalProtect App)
- [CVE-2024-2431](https://cve.now/CVE-2024-2431.md): GlobalProtect App: Local User Can Disable GlobalProtect (CVSS 5.5, Palo Alto Networks GlobalProtect App)
- [CVE-2024-28195](https://cve.now/CVE-2024-28195.md): Cross-Site Request Forgery (CSRF) vulnerability in API and login in your\_spotify (CVSS 8.1, Yooooomi your\_spotify)
- [CVE-2024-28196](https://cve.now/CVE-2024-28196.md): Clickjacking in your\_spotify (CVSS 6.5, Yooooomi your\_spotify)
- [CVE-2024-0173](https://cve.now/CVE-2024-0173.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. (CVSS 3.8, Dell PowerEdge Platform)
- [CVE-2024-20319](https://cve.now/CVE-2024-20319.md): A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured m (CVSS 4.3, Cisco IOS XR Software)
- [CVE-2024-20262](https://cve.now/CVE-2024-20262.md): A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to (CVSS 6.5, Cisco IOS XR Software)
- [CVE-2024-20318](https://cve.now/CVE-2024-20318.md): A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the lin (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2024-20315](https://cve.now/CVE-2024-20315.md): A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2024-20322](https://cve.now/CVE-2024-20322.md): A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2024-20266](https://cve.now/CVE-2024-20266.md): A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to tr (CVSS 5.3, Cisco IOS XR Software)
- [CVE-2024-20320](https://cve.now/CVE-2024-20320.md): A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) (CVSS 7.8, Cisco IOS XR Software)
- [CVE-2024-0154](https://cve.now/CVE-2024-0154.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. (CVSS 3.8, Dell PowerEdge Platform)
- [CVE-2024-20327](https://cve.now/CVE-2024-20327.md): A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2024-27953](https://cve.now/CVE-2024-27953.md): WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin \<= 2.6.8 is vulnerable to Broken Access Control (CVSS 4.7, Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins…)
- [CVE-2024-0163](https://cve.now/CVE-2024-0163.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. (CVSS 5.3, Dell PowerEdge BIOS Intel)
- [CVE-2024-0162](https://cve.now/CVE-2024-0162.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. (CVSS 5.3, Dell PowerEdge BIOS Intel)
- [CVE-2024-27952](https://cve.now/CVE-2024-27952.md): WordPress Advanced Sermons plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Codeus Advanced Sermons)
- [CVE-2024-25101](https://cve.now/CVE-2024-25101.md): WordPress Maspik – Spam blacklist Plugin \<= 0.10.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, yonifre Maspik – Spam Blacklist)
- [CVE-2024-0161](https://cve.now/CVE-2024-0161.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. (CVSS 7.2, Dell PowerEdge Platform)
- [CVE-2024-25099](https://cve.now/CVE-2024-25099.md): WordPress Paytium: Mollie payment forms & donations Plugin \<= 4.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, David de Boer Paytium: Mollie payment forms & donations)
- [CVE-2024-25097](https://cve.now/CVE-2024-25097.md): WordPress TNC PDF viewer Plugin \<= 2.8.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ThemeNcode TNC PDF viewer)
- [CVE-2024-26630](https://cve.now/CVE-2024-26630.md): mm: cachestat: fix folio read-after-free in cache walk (CVSS 7.1, Linux)
- [CVE-2024-23672](https://cve.now/CVE-2024-23672.md): Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVSS 6.3, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-24549](https://cve.now/CVE-2024-24549.md): Apache Tomcat: HTTP/2 header handling DoS (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-2000](https://cve.now/CVE-2024-2000.md): Premium Addons PRO \<= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll Widget (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-1668](https://cve.now/CVE-2024-1668.md): Avada \<= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries (CVSS 6.5, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2024-2238](https://cve.now/CVE-2024-2238.md): Premium Addons PRO \<= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-1997](https://cve.now/CVE-2024-1997.md): Premium Addons PRO \<= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat Widget (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-1996](https://cve.now/CVE-2024-1996.md): Premium Addons for Elementor PRO \<= 2.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget link (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-2237](https://cve.now/CVE-2024-2237.md): Premium Addons PRO \<= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-2239](https://cve.now/CVE-2024-2239.md): Premium Addons PRO \<= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module (CVSS 6.4, Premium Addons for Elementor Premium Addons Pro for Element…)
- [CVE-2024-1291](https://cve.now/CVE-2024-1291.md): Brizy – Page Builder \<= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2024-1894](https://cve.now/CVE-2024-1894.md): Burst Statistics – Privacy-Friendly Analytics for WordPress \<= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst\_total\_pageviews\_count (CVSS 6.4, burstbv Burst Statistics – Privacy-Friendly WordPress Analy…)
- [CVE-2024-1751](https://cve.now/CVE-2024-1751.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-0687](https://cve.now/CVE-2024-0687.md): Restrict User Access – Ultimate Membership & Content Protection \<= 2.5 - Information Exposure (CVSS 5.3, intoxstudio Restrict User Access – Ultimate Membership & Co…)
- [CVE-2024-1413](https://cve.now/CVE-2024-1413.md): Exclusive Addons for Elementor \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2023-6957](https://cve.now/CVE-2023-6957.md): Fluent Forms \<= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 4.9, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-1793](https://cve.now/CVE-2024-1793.md): AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber \<= 7.3.14 - Authenticated (Admin+) SQL Injection (CVSS 7.2, AWeber – Free Sign Up Form and Landing Page Builder Plugin…)
- [CVE-2024-1950](https://cve.now/CVE-2024-1950.md): Product Carousel Slider & Grid Ultimate for WooCommerce \<= 1.9.7 - Authenticated(Contributor+) PHP Object Injection (CVSS 7.5, wpwax Product Carousel Slider & Grid Ultimate for WooCommer…)
- [CVE-2024-2252](https://cve.now/CVE-2024-2252.md): Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder \<= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, droitthemes Droit Elementor Addons – Widgets, Blocks, Templ…)
- [CVE-2024-1489](https://cve.now/CVE-2024-1489.md): SMS Alert Order Notifications – WooCommerce \<= 3.6.9 - Cross-Site Request Forgery (CVSS 4.3, cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…)
- [CVE-2024-0368](https://cve.now/CVE-2024-0368.md): Hustle \<= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys (CVSS 8.6, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2024-1723](https://cve.now/CVE-2024-1723.md): SiteOrigin Widgets Bundle \<= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2024-2194](https://cve.now/CVE-2024-2194.md): WP Statistics \<= 14.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2024-1038](https://cve.now/CVE-2024-1038.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting (CVSS 5.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-1499](https://cve.now/CVE-2024-1499.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-0827](https://cve.now/CVE-2024-0827.md): Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \<= 3.6.4 - Cross-Site Request Forgery (CVSS 4.3, hammadh Play.ht – Make Your Blog Posts Accessible With Text…)
- [CVE-2024-1311](https://cve.now/CVE-2024-1311.md): Brizy – Page Builder \<= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, themefusecom Brizy – Page Builder)
- [CVE-2024-1080](https://cve.now/CVE-2024-1080.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-2286](https://cve.now/CVE-2024-2286.md): Sky Addons for Elementor \<= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL (CVSS 6.4, wowdevs Sky Addons – Elementor Addons with Widgets & Templa…)
- [CVE-2024-2028](https://cve.now/CVE-2024-2028.md): Exclusive Addons for Elementor \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-1806](https://cve.now/CVE-2024-1806.md): ProfilePress \<= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-1126](https://cve.now/CVE-2024-1126.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval (CVSS 4.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-0377](https://cve.now/CVE-2024-0377.md): LifterLMS – WordPress LMS Plugin for eLearning \<= 7.5.1 - Missing Authorization via process\_review (CVSS 5.3, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2024-1541](https://cve.now/CVE-2024-1541.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-0829](https://cve.now/CVE-2024-0829.md): Comments Extra Fields For Post,Pages and CPT \<= 5.0 - Missing Authorization (CVSS 4.3, nmedia Comments Extra Fields For Post,Pages and CPT)
- [CVE-2024-0369](https://cve.now/CVE-2024-0369.md): Bulk Edit Post Titles \<= 5.0.0 - Missing Authorization via bulkUpdatePostTitles (CVSS 4.3, pawaryogesh1989 Bulk Edit Post Titles)
- [CVE-2024-2030](https://cve.now/CVE-2024-2030.md): Database for Contact Form 7, WPforms, Elementor forms \<= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, crmperks Database for Contact Form 7, WPforms, Elementor fo…)
- [CVE-2024-1365](https://cve.now/CVE-2024-1365.md): YML for Yandex Market \<= 4.2.3 - Reflected Cross-Site Scripting (CVSS 6.1, icopydoc YML for Yandex Market)
- [CVE-2024-0683](https://cve.now/CVE-2024-0683.md): Bulgarisation for WooCommerce \<= 3.0.14 - Missing Authorization (CVSS 7.3, autopolisbg Bulgarisation for WooCommerce)
- [CVE-2024-1393](https://cve.now/CVE-2024-1393.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-1497](https://cve.now/CVE-2024-1497.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2\_width attribute (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2023-5663](https://cve.now/CVE-2023-5663.md): News Announcement Scroll \<= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, storeapps News Announcement Scroll)
- [CVE-2024-1505](https://cve.now/CVE-2024-1505.md): Academy LMS – eLearning and online course solution for WordPress \<= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, kodezen Academy LMS – WordPress LMS Plugin for Complete eLe…)
- [CVE-2024-1951](https://cve.now/CVE-2024-1951.md): Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid \<= 1.3.8 - Authenticated(Contributor+) PHP Object Injection (CVSS 7.5, wpwax Logo Showcase Ultimate – Logo Carousel, Logo Slider &…)
- [CVE-2024-0700](https://cve.now/CVE-2024-0700.md): Simple Tweet \<= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, wokamoto Simple Tweet)
- [CVE-2024-0898](https://cve.now/CVE-2024-0898.md): Chat Bubble \<= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, bluecoral Chat Bubble – Floating Chat with Contact Chat Ico…)
- [CVE-2024-1074](https://cve.now/CVE-2024-1074.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-0681](https://cve.now/CVE-2024-0681.md): Page Restriction WordPress (WP) – Protect WP Pages/Post \<= 1.3.4 - Protection Mechanism Bypass (CVSS 5.3, cyberlord92 Page and Post Restriction)
- [CVE-2024-0631](https://cve.now/CVE-2024-0631.md): Duitku Payment Gateway \<= 2.11.6 - Missing Authorization via check\_duitku\_response (CVSS 5.3, rayhanduitku Duitku Payment Gateway)
- [CVE-2023-6809](https://cve.now/CVE-2023-6809.md): Custom fields shortcode \<= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, gonahkar Custom fields shortcode)
- [CVE-2024-1391](https://cve.now/CVE-2024-1391.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-0896](https://cve.now/CVE-2024-0896.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2023-7015](https://cve.now/CVE-2023-7015.md): File Manager Pro \<= 8.3.4 - Reflected Cross-Site Scripting (CVSS 6.1, File Manager Pro)
- [CVE-2023-6825](https://cve.now/CVE-2023-6825.md): File Manager And File Manager Pro (Multiple Versions) - Directory Traversal (CVSS 9.9, mndpsingh287 File Manager · File Manager Pro)
- [CVE-2024-1684](https://cve.now/CVE-2024-1684.md): Otter Blocks PRO \<= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS (CVSS 6.4, Themisle Otter Blocks PRO – Gutenberg Blocks, Page Builder…)
- [CVE-2024-0830](https://cve.now/CVE-2024-0830.md): Comments Extra Fields For Post,Pages and CPT \<= 5.0 - Cross-Site Request Forgery (CVSS 4.3, nmedia Comments Extra Fields For Post,Pages and CPT)
- [CVE-2024-2006](https://cve.now/CVE-2024-2006.md): Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget \<= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost\_shortcode\_metabox\_markup (CVSS 8.8, wpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…)
- [CVE-2024-1985](https://cve.now/CVE-2024-1985.md): Simple Membership \<= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting (CVSS 4.7, wpinsider-1 Simple Membership)
- [CVE-2024-1363](https://cve.now/CVE-2024-1363.md): Easy Accordion – Best Accordion FAQ Plugin for WordPress \<= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, shapedplugin Easy Accordion – Responsive Accordion FAQ Buil…)
- [CVE-2024-1854](https://cve.now/CVE-2024-1854.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-0447](https://cve.now/CVE-2024-0447.md): ArtiBot Free Chat Bot for WordPress WebSites \<= 1.1.6 - Missing Authorization to Settings Update (CVSS 5.0, ArtiBot Free Chat Bot for WebSites)
- [CVE-2024-1772](https://cve.now/CVE-2024-1772.md): Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \<= 3.6.4 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, hammadh Play.ht – Make Your Blog Posts Accessible With Text…)
- [CVE-2024-1237](https://cve.now/CVE-2024-1237.md): Elementor Header & Footer Builder \<= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-2293](https://cve.now/CVE-2024-2293.md): Site Reviews \<= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name (CVSS 6.4, geminilabs Site Reviews)
- [CVE-2024-1537](https://cve.now/CVE-2024-1537.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-1203](https://cve.now/CVE-2024-1203.md): Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce \<= 7.0.7 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, tatvic Conversios: Google Analytics (GA4), Google Ads, Conv…)
- [CVE-2023-6785](https://cve.now/CVE-2023-6785.md): Download Manager \<= 3.2.84 - Missing Authorization (CVSS 5.3, codename065 Download Manager)
- [CVE-2024-1380](https://cve.now/CVE-2024-1380.md): Relevanssi – A Better Search \<= 4.22.0 (Free) and \<= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export (CVSS 5.3, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2024-1691](https://cve.now/CVE-2024-1691.md): Otter Blocks PRO \<= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload (CVSS 6.1, Themisle Otter Blocks PRO – Gutenberg Blocks, Page Builder…)
- [CVE-2023-6969](https://cve.now/CVE-2023-6969.md): User Shortcodes Plus \<= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user\_meta Shortcode (CVSS 4.3, kbjohnson90 User Shortcodes Plus)
- [CVE-2024-1321](https://cve.now/CVE-2024-1321.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Unauthenticated Booking Payment Bypass (CVSS 5.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-1680](https://cve.now/CVE-2024-1680.md): Premium Addons for Elementor \<= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-1414](https://cve.now/CVE-2024-1414.md): Exclusive Addons for Elementor \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-1479](https://cve.now/CVE-2024-1479.md): WP Show Posts \<= 1.1.4 - Information Exposure (CVSS 5.3, edge22 WP Show Posts)
- [CVE-2024-1083](https://cve.now/CVE-2024-1083.md): Simple Restrict \<= 1.2.6 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, wpchill Simple Restrict)
- [CVE-2024-1462](https://cve.now/CVE-2024-1462.md): Maintenance Page \<= 1.0.8 - Security Mechanism Bypass via REST API (CVSS 5.3, themegrill Maintenance Page)
- [CVE-2024-2172](https://cve.now/CVE-2024-2172.md): Malware Scanner \<= 4.7.2 and Web Application Firewall \<= 2.1.1 - Unauthenticated Privilege Escalation (CVSS 9.8, cyberlord92 Web Application Firewall – website security · c…)
- [CVE-2024-1452](https://cve.now/CVE-2024-1452.md): GenerateBlocks \<= 1.8.2 - Sensitive Information Exposure (CVSS 4.3, edge22 GenerateBlocks)
- [CVE-2024-0614](https://cve.now/CVE-2024-0614.md): Events Manager \<= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings (CVSS 4.4, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2023-6880](https://cve.now/CVE-2023-6880.md): Visual Composer Premium \<= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, visualcomposer Visual Composer Website Builder)
- [CVE-2024-0592](https://cve.now/CVE-2024-0592.md): Related Posts for WordPress \<= 2.2.1 - Cross-Site Request Forgery (CVSS 5.4, barrykooij Related Posts for WordPress)
- [CVE-2023-6954](https://cve.now/CVE-2023-6954.md): Download Manager \<= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2024-0591](https://cve.now/CVE-2024-0591.md): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin \<= 3.4.2.2 - Reflected Cross-Site Scripting. (CVSS 6.1, wpDataTables – WordPress Data Table, Dynamic Tables & Table…)
- [CVE-2024-1293](https://cve.now/CVE-2024-1293.md): Brizy – Page Builder \<= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2024-0828](https://cve.now/CVE-2024-0828.md): Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio \<= 3.6.4 - Missing Authorization (CVSS 5.4, hammadh Play.ht – Make Your Blog Posts Accessible With Text…)
- [CVE-2024-1409](https://cve.now/CVE-2024-1409.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via \[reg-select-role\] Shortcode (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-1763](https://cve.now/CVE-2024-1763.md): Wp Social Login and Register Social Counter \<= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update (CVSS 6.5, roxnor Wp Social Login and Register Social Counter)
- [CVE-2024-0976](https://cve.now/CVE-2024-0976.md): WP Event Manager \<= 3.1.41 - Reflected Cross-Site Scripting via plugin (CVSS 6.1, wpeventmanager WP Event Manager – Events Calendar, Registra…)
- [CVE-2024-1422](https://cve.now/CVE-2024-1422.md): Elementor Addon Elements \<= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-1640](https://cve.now/CVE-2024-1640.md): Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form \<= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alteration (CVSS 5.3, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2024-2020](https://cve.now/CVE-2024-2020.md): Calculated Fields Form Professional \<= 5.1.56 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, codepeople Calculated Fields Form)
- [CVE-2024-0449](https://cve.now/CVE-2024-0449.md): ArtiBot Free Chat Bot for WordPress WebSites \<= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting (CVSS 4.4, ArtiBot Free Chat Bot for WebSites)
- [CVE-2024-1296](https://cve.now/CVE-2024-1296.md): Brizy – Page Builder \<= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2024-1484](https://cve.now/CVE-2024-1484.md): Booking for Appointments and Events Calendar – Amelia \<= 1.0.98 - Reflected Cross-Site Scripting (CVSS 6.1, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2024-1127](https://cve.now/CVE-2024-1127.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export (CVSS 4.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-1535](https://cve.now/CVE-2024-1535.md): ProfilePress \<= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-1862](https://cve.now/CVE-2024-1862.md): WooCommerce Add to Cart Custom Redirect \<= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update (CVSS 8.1, forwardflip Add to Cart Custom Redirect for WooCommerce)
- [CVE-2024-1585](https://cve.now/CVE-2024-1585.md): Metform Elementor Contact Form Builder \<= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2024-1392](https://cve.now/CVE-2024-1392.md): Elementor Addon Elements \<= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-1642](https://cve.now/CVE-2024-1642.md): MainWP Dashboard \<= 4.6.0.1 - Cross-Site Request Forgery via posting\_bulk (CVSS 4.3, MainWP Dashboard: Self-hosted WordPress Management for Agen…)
- [CVE-2024-1383](https://cve.now/CVE-2024-1383.md): WPvivid Backup for MainWP \<= 0.9.32 - Reflected Cross-Site Scripting (CVSS 6.1, wpvividplugins WPvivid Backup for MainWP)
- [CVE-2024-1935](https://cve.now/CVE-2024-1935.md): Giveaways and Contests by RafflePress \<= 1.12.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, smub Giveaways and Contests by RafflePress – Get More Websi…)
- [CVE-2024-2106](https://cve.now/CVE-2024-2106.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.2.10 - Basic Information Exposure via REST route (CVSS 5.3, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-0871](https://cve.now/CVE-2024-0871.md): Beaver Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (CVSS 5.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-0326](https://cve.now/CVE-2024-0326.md): Premium Addons for Elementor \<= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-0897](https://cve.now/CVE-2024-0897.md): Beaver Builder – WordPress Page Builder \<= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-1358](https://cve.now/CVE-2024-1358.md): Elementor Addon Elements \<= 1.12.12 - Directory Traversal to Local File Inclusion (CVSS 8.8, wpvibes Addon Elements for Elementor)
- [CVE-2024-1370](https://cve.now/CVE-2024-1370.md): Maintenance Page \<= 1.0.8 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, themegrill Maintenance Page)
- [CVE-2024-0839](https://cve.now/CVE-2024-0839.md): FeedWordPress \<= 2022.0222 - Insecure Direct Object Referece (CVSS 5.3, radgeek FeedWordPress)
- [CVE-2024-0385](https://cve.now/CVE-2024-0385.md): Categorify \<= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1234](https://cve.now/CVE-2024-1234.md): Exclusive Addons for Elementor \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-1158](https://cve.now/CVE-2024-1158.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.7 - Missing Authorization (CVSS 4.3, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-1690](https://cve.now/CVE-2024-1690.md): TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds \<= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export (CVSS 4.3, subratamal Wallet for WooCommerce)
- [CVE-2024-1536](https://cve.now/CVE-2024-1536.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar (CVSS 7.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-1176](https://cve.now/CVE-2024-1176.md): HT Easy GA4 – Google Analytics WordPress Plugin \<= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update (CVSS 5.3, htplugins HT Easy GA4 – Google Analytics WordPress Plugin)
- [CVE-2024-1843](https://cve.now/CVE-2024-1843.md): Auto Affiliate Links \<= 6.4.3 - Missing Authorization via aalAddLink (CVSS 4.3, thedark Auto Affiliate Links)
- [CVE-2024-2126](https://cve.now/CVE-2024-2126.md): Orbit Fox by ThemeIsle \<= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-1071](https://cve.now/CVE-2024-1071.md): The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v (CVSS 9.8, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-25155](https://cve.now/CVE-2024-25155.md): Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier (CVSS 7.2, Fortra FileCatalyst)
- [CVE-2024-25154](https://cve.now/CVE-2024-25154.md): Path Traversal in FileCatalyst Direct 3.8.8 and Earlier (CVSS 5.3, Fortra FileCatalyst)
- [CVE-2024-25153](https://cve.now/CVE-2024-25153.md): Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114 (CVSS 9.8, Fortra FileCatalyst)
- [CVE-2024-2247](https://cve.now/CVE-2024-2247.md): JFrog Artifactory Cross-Site Scripting (CVSS 8.8, JFrog Artifactory)
- [CVE-2024-26629](https://cve.now/CVE-2024-26629.md): nfsd: fix RELEASE\_LOCKOWNER (no CVSS, Linux)
- [CVE-2023-52608](https://cve.now/CVE-2023-52608.md): firmware: arm\_scmi: Check mailbox/SMT channel for consistency (no CVSS, Linux)
- [CVE-2024-1508](https://cve.now/CVE-2024-1508.md): Prime Slider – Addons For Elementor \<= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-1507](https://cve.now/CVE-2024-1507.md): Prime Slider – Addons For Elementor \<= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-2415](https://cve.now/CVE-2024-2415.md): Command injection vulnerability in Movistar 4G router (CVSS 7.8, Router Movistar)
- [CVE-2024-2416](https://cve.now/CVE-2024-2416.md): Cross-Site Request Forgery vulnerability in Movistar 4G router (CVSS 6.5, Router Movistar)
- [CVE-2024-2414](https://cve.now/CVE-2024-2414.md): Unprotected Primary Channel vulnerability in Movistar 4G router (CVSS 8.8, Router Movistar)
- [CVE-2024-1979](https://cve.now/CVE-2024-1979.md): Quarkus: information leak in annotation (CVSS 3.5, quarkus · Red Hat build of Quarkus 3.2.11.Final +2)
- [CVE-2024-2123](https://cve.now/CVE-2024-2123.md): Ultimate Member \<= 2.8.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2023-32335](https://cve.now/CVE-2023-32335.md): IBM Maximo Application Suite information disclosure (CVSS 3.7, IBM Maximo Application Suite · IBM Maximo Asset Management)
- [CVE-2023-43043](https://cve.now/CVE-2023-43043.md): IBM Maximo Application Suite information disclosure (CVSS 5.1, IBM Maximo Application Suite - Maximo Mobile for EAM)
- [CVE-2023-38723](https://cve.now/CVE-2023-38723.md): Maximo Asset Management cross-site scripting (CVSS 6.4, IBM Maximo Asset Management)
- [CVE-2023-28517](https://cve.now/CVE-2023-28517.md): IBM Sterling Partner Engagement Manager cross-site scripting (CVSS 5.4, IBM Sterling Partner Engagement Manager)
- [CVE-2018-25090](https://cve.now/CVE-2018-25090.md): Wago: Improper Neutralization of Input During Web Page Generation in multiple devices (CVSS 5.4, WAGO Controller BACnet/IP · WAGO Controller BACnet MS/TP +2)
- [CVE-2015-10123](https://cve.now/CVE-2015-10123.md): Wago: Buffer Copy without Checking Size of Input in wbm of multiple products (CVSS 8.8, WAGO Controller BACnet/IP · WAGO Controller BACnet MS/TP +2)
- [CVE-2024-27440](https://cve.now/CVE-2024-27440.md): The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly ve (CVSS 4.8, Toyoko Inn IT Solution Co. Toyoko Inn official App for iOS…)
- [CVE-2024-2400](https://cve.now/CVE-2024-2400.md): Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corrupt (CVSS 8.8, Google Chrome)
- [CVE-2024-2413](https://cve.now/CVE-2024-2413.md): Intumit SmartRobot - Use of Hard-coded Cryptographic Key (CVSS 9.8, Intumit SmartRobot)
- [CVE-2015-10130](https://cve.now/CVE-2015-10130.md): The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. (CVSS 5.3, nik00726 Team Circle Image Slider With Lightbox)
- [CVE-2024-2412](https://cve.now/CVE-2024-2412.md): Heimavista Rpage and Epage - Broken Access Control (CVSS 5.3, Heimavista Rpage · Heimavista Epage)
- [CVE-2024-1582](https://cve.now/CVE-2024-1582.md): WP Go Maps (formerly WP Google Maps) \<= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpgmaps WP Go Maps)
- [CVE-2023-4839](https://cve.now/CVE-2023-4839.md): WP Go Maps \<= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpgmaps WP Go Maps)
- [CVE-2023-36238](https://cve.now/CVE-2023-36238.md): Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. (CVSS 6.5, bagisto/bagisto)
- [CVE-2023-41504](https://cve.now/CVE-2023-41504.md): SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function. (CVSS 8.8)
- [CVE-2023-41505](https://cve.now/CVE-2023-41505.md): An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to e (CVSS 9.8)
- [CVE-2024-24105](https://cve.now/CVE-2024-24105.md): SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvali (CVSS 7.8)
- [CVE-2024-25250](https://cve.now/CVE-2024-25250.md): SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page. (CVSS 9.8)
- [CVE-2024-26529](https://cve.now/CVE-2024-26529.md): An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer\_hand (CVSS 7.5)
- [CVE-2024-27703](https://cve.now/CVE-2024-27703.md): Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter. (CVSS 5.4)
- [CVE-2024-28429](https://cve.now/CVE-2024-28429.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives\_do.php (CVSS 5.5)
- [CVE-2024-28430](https://cve.now/CVE-2024-28430.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog\_edit.php. (CVSS 6.1)
- [CVE-2024-28431](https://cve.now/CVE-2024-28431.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog\_del.php. (CVSS 8.8)
- [CVE-2024-28432](https://cve.now/CVE-2024-28432.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article\_edit.php. (CVSS 8.8)
- [CVE-2024-28623](https://cve.now/CVE-2024-28623.md): RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main\_menu/edit\_section. (CVSS 6.1)
- [CVE-2024-28662](https://cve.now/CVE-2024-28662.md): A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create\_tag in admin/include/fu (CVSS 5.4)
- [CVE-2024-28665](https://cve.now/CVE-2024-28665.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article\_add.php (CVSS 8.8)
- [CVE-2024-28666](https://cve.now/CVE-2024-28666.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media\_add.php (CVSS 5.5)
- [CVE-2024-28667](https://cve.now/CVE-2024-28667.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets\_one\_edit.php (CVSS 6.1)
- [CVE-2024-28668](https://cve.now/CVE-2024-28668.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel\_add.php (CVSS 6.1)
- [CVE-2024-28669](https://cve.now/CVE-2024-28669.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist\_edit.php. (CVSS 5.4)
- [CVE-2024-28670](https://cve.now/CVE-2024-28670.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist\_main.php. (CVSS 6.1)
- [CVE-2024-28671](https://cve.now/CVE-2024-28671.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect\_main.php. (CVSS 8.8)
- [CVE-2024-28672](https://cve.now/CVE-2024-28672.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media\_edit.php. (CVSS 5.4)
- [CVE-2024-28673](https://cve.now/CVE-2024-28673.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel\_edit.php. (CVSS 8.8)
- [CVE-2024-28675](https://cve.now/CVE-2024-28675.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy\_edit.php (CVSS 8.8)
- [CVE-2024-28676](https://cve.now/CVE-2024-28676.md): DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article\_edit.php. (CVSS 6.1)
- [CVE-2024-28677](https://cve.now/CVE-2024-28677.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article\_keywords\_main.php. (CVSS 6.1)
- [CVE-2024-28678](https://cve.now/CVE-2024-28678.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article\_description\_main.ph (CVSS 6.3)
- [CVE-2024-28679](https://cve.now/CVE-2024-28679.md): DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection. (CVSS 6.1)
- [CVE-2024-28680](https://cve.now/CVE-2024-28680.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy\_add.php. (CVSS 6.1)
- [CVE-2024-28681](https://cve.now/CVE-2024-28681.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus\_edit.php. (CVSS 6.1)
- [CVE-2024-28682](https://cve.now/CVE-2024-28682.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys\_cache\_up.php. (CVSS 6.3)
- [CVE-2024-28683](https://cve.now/CVE-2024-28683.md): DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file. (CVSS 6.1)
- [CVE-2024-28684](https://cve.now/CVE-2024-28684.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module\_main.php (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.