# CVEs published 2024-03-23

17 CVEs were published on March 23, 2024: 0 critical, 6 high. Days are UTC.

- [CVE-2024-1603](https://cve.now/CVE-2024-1603.md): confirmed (CVSS 8.2, paddlepaddle/paddle · paddlepaddle)
- [CVE-2024-2849](https://cve.now/CVE-2024-2849.md): SourceCodester Simple File Manager unrestricted upload (CVSS 6.3, SourceCodester Simple File Manager)
- [CVE-2024-24832](https://cve.now/CVE-2024-24832.md): WordPress EventPrime plugin \<= 3.3.9 - Broken Access Control vulnerability (CVSS 8.2, Metagauss EventPrime)
- [CVE-2024-24835](https://cve.now/CVE-2024-24835.md): WordPress BEAR plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 4.3, realmag777 BEAR)
- [CVE-2024-24840](https://cve.now/CVE-2024-24840.md): WordPress Element Pack Elementor Addons plugin \<= 5.4.11 - Broken Access Control on Duplicate Post vulnerability (CVSS 4.3, BdThemes Element Pack Elementor Addons)
- [CVE-2021-33633](https://cve.now/CVE-2021-33633.md): Command Injection in aops-ceres (CVSS 7.3, openEuler aops-ceres)
- [CVE-2024-2832](https://cve.now/CVE-2024-2832.md): Campcodes Online Shopping System offersmail.php cross site scripting (CVSS 3.5, Campcodes Online Shopping System)
- [CVE-2024-2326](https://cve.now/CVE-2024-2326.md): Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin \<= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, supercleanse PrettyLinks – Affiliate Links, Link Branding,…)
- [CVE-2024-1049](https://cve.now/CVE-2024-1049.md): Page Builder Gutenberg Blocks – CoBlocks \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, godaddy Page Builder Gutenberg Blocks – CoBlocks)
- [CVE-2024-2468](https://cve.now/CVE-2024-2468.md): EmbedPress \<= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-2688](https://cve.now/CVE-2024-2688.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress\_doc\_custom\_color' (CVSS 5.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-2202](https://cve.now/CVE-2024-2202.md): Page Builder by SiteOrigin \<= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget (CVSS 6.4, gpriday Page Builder by SiteOrigin)
- [CVE-2024-2131](https://cve.now/CVE-2024-2131.md): Move Addons for Elementor \<= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, moveaddons Move Addons for Elementor)
- [CVE-2024-1697](https://cve.now/CVE-2024-1697.md): Custom WooCommerce Checkout Fields Editor \<= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, themelocation Custom WooCommerce Checkout Fields Editor)
- [CVE-2024-2025](https://cve.now/CVE-2024-2025.md): BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages \<= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get\_simple\_request (CVSS 8.8, themekraft BuddyPress WooCommerce My Account Integration. C…)
- [CVE-2024-23755](https://cve.now/CVE-2024-23755.md): ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. (CVSS 8.8)
- [CVE-2024-24725](https://cve.now/CVE-2024-24725.md): Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the mod (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.