# CVEs published 2024-03-29

156 CVEs were published on March 29, 2024: 22 critical, 45 high. Days are UTC.

- [CVE-2024-30431](https://cve.now/CVE-2024-30431.md): WordPress Mang Board WP plugin \<= 1.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hometory Mang Board WP)
- [CVE-2024-30432](https://cve.now/CVE-2024-30432.md): WordPress B Slider plugin \<= 1.1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins B Slider - Slider for your block editor)
- [CVE-2024-30433](https://cve.now/CVE-2024-30433.md): WordPress MultiVendorX Marketplace plugin \<= 4.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MultiVendorX WC Marketplace)
- [CVE-2024-30434](https://cve.now/CVE-2024-30434.md): WordPress WP-CRM System plugin \<= 3.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP-CRM System)
- [CVE-2024-30435](https://cve.now/CVE-2024-30435.md): WordPress Nexter Blocks plugin \<= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, POSIMYTH Nexter Blocks)
- [CVE-2024-30436](https://cve.now/CVE-2024-30436.md): WordPress Collect.chat plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Collect.chat Collectchat)
- [CVE-2024-30437](https://cve.now/CVE-2024-30437.md): WordPress Webinar and Video Conference with Jitsi Meet plugin \<= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPPOOL Webinar and Video Conference with Jitsi Meet)
- [CVE-2024-30438](https://cve.now/CVE-2024-30438.md): WordPress Print Page block plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Print Page block)
- [CVE-2024-30439](https://cve.now/CVE-2024-30439.md): WordPress Limit Attempts by BestWebSoft plugin \<= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Limit Attempts by BestWebSoft)
- [CVE-2024-30440](https://cve.now/CVE-2024-30440.md): WordPress Themify Event Post plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themify Event Post)
- [CVE-2024-30441](https://cve.now/CVE-2024-30441.md): WordPress Combo Blocks plugin \<= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PickPlugins Post Grid)
- [CVE-2024-30442](https://cve.now/CVE-2024-30442.md): WordPress Bold Page Builder plugin \<= 4.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BoldThemes Bold Page Builder)
- [CVE-2024-30443](https://cve.now/CVE-2024-30443.md): WordPress GS Testimonial Slider plugin \<= 3.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GS Plugins GS Testimonial Slider)
- [CVE-2024-30444](https://cve.now/CVE-2024-30444.md): WordPress WordPress Page Builder – Zion Builder plugin \<= 3.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, zionbuilder.io WordPress Page Builder – Zion Builder)
- [CVE-2024-30445](https://cve.now/CVE-2024-30445.md): WordPress Web Icons plugin \<= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Web Icons)
- [CVE-2024-30446](https://cve.now/CVE-2024-30446.md): WordPress CRM Perks Forms plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CRM Perks Forms)
- [CVE-2024-30447](https://cve.now/CVE-2024-30447.md): WordPress Creative Image Slider plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Creative Solutions Creative Image Slider – Responsive Slide…)
- [CVE-2024-3094](https://cve.now/CVE-2024-3094.md): Xz: malicious code in distributed source (CVSS 10.0, xz · Red Hat Enterprise Linux +1)
- [CVE-2024-30448](https://cve.now/CVE-2024-30448.md): WordPress Slider by Supsystic plugin \<= 1.8.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Slider by Supsystic)
- [CVE-2024-30449](https://cve.now/CVE-2024-30449.md): WordPress Booking Activities plugin \<= 1.15.19 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Booking Activities Team Booking Activities)
- [CVE-2024-30450](https://cve.now/CVE-2024-30450.md): WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Step-Byte-Service OpenStreetMap for Gutenberg and WPBakery…)
- [CVE-2024-30451](https://cve.now/CVE-2024-30451.md): WordPress Geo Controller plugin \<= 8.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, INFINITUM FORM Geo Controller)
- [CVE-2024-30452](https://cve.now/CVE-2024-30452.md): WordPress Landing Page Builder plugin \<= 1.5.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, PluginOps Landing Page Builder)
- [CVE-2024-30453](https://cve.now/CVE-2024-30453.md): WordPress Brave plugin \<= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Brave Popup Builder)
- [CVE-2024-30455](https://cve.now/CVE-2024-30455.md): WordPress GamiPress plugin \<= 6.8.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, GamiPress)
- [CVE-2024-30460](https://cve.now/CVE-2024-30460.md): WordPress Tumult Hype Animations plugin \<= 1.9.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tumult Hype Animations)
- [CVE-2024-30454](https://cve.now/CVE-2024-30454.md): WordPress WP SMS plugin \<= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, VeronaLabs WP SMS)
- [CVE-2024-25944](https://cve.now/CVE-2024-25944.md): Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. (CVSS 5.7, Dell OpenManage Enterprise)
- [CVE-2024-30462](https://cve.now/CVE-2024-30462.md): WordPress HUSKY plugin \<= 1.3.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 HUSKY – Products Filter for WooCommerce)
- [CVE-2024-30463](https://cve.now/CVE-2024-30463.md): WordPress BEAR plugin \<= 1.1.4.3 - Broken Access Control vulnerability (CVSS 4.3, realmag777 BEAR)
- [CVE-2024-30468](https://cve.now/CVE-2024-30468.md): WordPress All-In-One Security (AIOS) – Security and Firewall plugin \<= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, All In One WP Security & Firewall Team All In One WP Securi…)
- [CVE-2024-30477](https://cve.now/CVE-2024-30477.md): WordPress Klarna Payments for WooCommerce plugin \<= 3.2.4 - Broken Access Control vulnerability (CVSS 5.3, Klarna Payments for WooCommerce)
- [CVE-2024-30482](https://cve.now/CVE-2024-30482.md): WordPress Simple Revisions Delete plugin \<= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Brice CAPOBIANCO Simple Revisions Delete)
- [CVE-2024-30247](https://cve.now/CVE-2024-30247.md): Command Injection as root in NextCloudPi web panel (CVSS 10.0, nextcloudpi)
- [CVE-2024-30518](https://cve.now/CVE-2024-30518.md): WordPress Custom WooCommerce Checkout Fields Editor plugin \<= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThemeLocation Custom WooCommerce Checkout Fields Editor)
- [CVE-2024-30521](https://cve.now/CVE-2024-30521.md): WordPress Landingi Landing Pages plugin \<= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Landingi Landing Pages)
- [CVE-2024-30246](https://cve.now/CVE-2024-30246.md): Tuleap deleting or moving an artifact can delete values from unrelated artifacts (CVSS 7.6, Enalean tuleap)
- [CVE-2024-30513](https://cve.now/CVE-2024-30513.md): WordPress ProfileGrid plugin \<= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Metagauss ProfileGrid)
- [CVE-2024-30469](https://cve.now/CVE-2024-30469.md): WordPress Wholesale For WooCommerce plugin \<= 2.3.0 - Unauthenticated Sensitive Data Exposure vulnerability (CVSS 5.3, WPExperts Wholesale For WooCommerce)
- [CVE-2024-30511](https://cve.now/CVE-2024-30511.md): WordPress FG PrestaShop to WooCommerce plugin \<= 4.45.1 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Frédéric GILLES FG PrestaShop to WooCommerce)
- [CVE-2024-30514](https://cve.now/CVE-2024-30514.md): WordPress Paid Memberships Pro – Payfast Gateway Add On plugin \<= 1.4.1 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Paid Memberships Pro – Payfast Gateway Add On)
- [CVE-2024-30492](https://cve.now/CVE-2024-30492.md): WordPress Export and Import Users and Customers plugin \<= 2.5.2 - Path Traversal vulnerability (CVSS 4.3, WebToffee Import Export WordPress Users)
- [CVE-2024-29904](https://cve.now/CVE-2024-29904.md): CodeIgniter4 Language class DoS Vulnerability (CVSS 7.5, CodeIgniter4 · codeigniter4/framework)
- [CVE-2024-29901](https://cve.now/CVE-2024-29901.md): @workos-inc/authkit-nextjs session replay vulnerability (CVSS 4.8, workos authkit-nextjs · @workos-inc/authkit-nextjs)
- [CVE-2024-29900](https://cve.now/CVE-2024-29900.md): @electron/packager's build process memory potentially leaked into final executable (CVSS 7.5, electron packager · @electron/packager)
- [CVE-2024-29893](https://cve.now/CVE-2024-29893.md): Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server (CVSS 6.5, argoproj argo-cd · github.com/argoproj/argo-cd/v2)
- [CVE-2024-29890](https://cve.now/CVE-2024-29890.md): Remote code execution in datalens-ui (CVSS 8.8, datalens-tech datalens)
- [CVE-2024-29202](https://cve.now/CVE-2024-29202.md): JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery (CVSS 10.0, jumpserver)
- [CVE-2024-29201](https://cve.now/CVE-2024-29201.md): JumpServer's insecure Ansible playbook validation leads to RCE in Celery (CVSS 10.0, jumpserver)
- [CVE-2024-29020](https://cve.now/CVE-2024-29020.md): JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook\_id is leaked (CVSS 4.6, jumpserver)
- [CVE-2024-29024](https://cve.now/CVE-2024-29024.md): JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality (CVSS 4.6, jumpserver)
- [CVE-2024-23537](https://cve.now/CVE-2024-23537.md): Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. (CVSS 8.4, Apache Software Foundation Apache Fineract)
- [CVE-2024-23538](https://cve.now/CVE-2024-23538.md): Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. (CVSS 9.9, Apache Software Foundation Apache Fineract)
- [CVE-2024-23539](https://cve.now/CVE-2024-23539.md): Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. (CVSS 8.3, Apache Software Foundation Apache Fineract)
- [CVE-2024-3081](https://cve.now/CVE-2024-3081.md): EasyCorp EasyAdmin Autocomplete autocomplete.js cross site scripting (CVSS 3.5, EasyCorp EasyAdmin)
- [CVE-2024-28867](https://cve.now/CVE-2024-28867.md): Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics (CVSS 5.9, swift-server swift-prometheus)
- [CVE-2024-30508](https://cve.now/CVE-2024-30508.md): WordPress WP Hotel Booking plugin \<= 2.0.9.2 - Broken Access Control vulnerability (CVSS 6.5, ThimPress WP Hotel Booking)
- [CVE-2024-30507](https://cve.now/CVE-2024-30507.md): WordPress Molongui Authorship plugin \<= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 2.7, Molongui)
- [CVE-2024-30506](https://cve.now/CVE-2024-30506.md): WordPress All In One Redirection plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vsourz Digital All In One Redirection)
- [CVE-2024-30505](https://cve.now/CVE-2024-30505.md): WordPress Church Admin plugin \<= 4.1.18 - Broken Access Control vulnerability (CVSS 5.4, andy\_moyle Church Admin)
- [CVE-2024-30504](https://cve.now/CVE-2024-30504.md): WordPress WP Travel Engine plugin \<= 5.7.9 - SQL Injection vulnerability (CVSS 7.6, WP Travel Engine)
- [CVE-2024-30502](https://cve.now/CVE-2024-30502.md): WordPress WP Travel Engine plugin \<= 5.7.9 - Unauth. Blind SQL Injection vulnerability (CVSS 9.3, WP Travel Engine)
- [CVE-2024-30501](https://cve.now/CVE-2024-30501.md): WordPress Download Monitor theme \<= 4.9.4 - Auth. SQL Injection vulnerability (CVSS 7.6, WPChill Download Monitor)
- [CVE-2024-30499](https://cve.now/CVE-2024-30499.md): WordPress CRM Perks Forms plugin \<= 1.1.4 - SQL Injection vulnerability (CVSS 8.5, CRM Perks Forms)
- [CVE-2024-30498](https://cve.now/CVE-2024-30498.md): WordPress CRM Perks Forms plugin \<= 1.1.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, CRM Perks Forms)
- [CVE-2024-30497](https://cve.now/CVE-2024-30497.md): WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin \<= 1.1.17 - SQL Injection vulnerability (CVSS 8.5, I Thirteen Web Solution WP Responsive Tabs horizontal verti…)
- [CVE-2024-30496](https://cve.now/CVE-2024-30496.md): WordPress Element Pack Lite plugin \<= 5.5.3 - SQL Injection vulnerability (CVSS 8.5, BdThemes Element Pack Elementor Addons)
- [CVE-2024-30495](https://cve.now/CVE-2024-30495.md): WordPress Falang multilanguage for WordPress plugin \<= 1.3.47 - SQL Injection vulnerability (CVSS 7.6, Faboba Falang multilanguage)
- [CVE-2024-30494](https://cve.now/CVE-2024-30494.md): WordPress OSS Aliyun plugin \<= 1.4.10 - SQL Injection vulnerability (CVSS 7.6, 沈唁 OSS Aliyun)
- [CVE-2024-30493](https://cve.now/CVE-2024-30493.md): WordPress Church Admin plugin \<= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, andy\_moyle Church Admin)
- [CVE-2024-30491](https://cve.now/CVE-2024-30491.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.8 - SQL Injection vulnerability (CVSS 8.5, Metagauss ProfileGrid)
- [CVE-2024-30490](https://cve.now/CVE-2024-30490.md): WordPress ProfileGrid plugin \<= 5.7.8 - SQL Injection vulnerability (CVSS 9.3, Metagauss ProfileGrid)
- [CVE-2024-30488](https://cve.now/CVE-2024-30488.md): WordPress Zotpress plugin \<= 7.3.7 - SQL Injection vulnerability (CVSS 8.5, Katie Zotpress)
- [CVE-2024-30487](https://cve.now/CVE-2024-30487.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 5.1 - Broken Access Control vulnerability (CVSS 7.6, Sonaar Music MP3 Audio Player for Music, Radio & Podcast by…)
- [CVE-2024-30486](https://cve.now/CVE-2024-30486.md): WordPress Media Library Folders plugin \<= 8.1.7 - Auth. SQL Injection vulnerability (CVSS 8.5, Max Foundry Media Library Folders)
- [CVE-2024-30478](https://cve.now/CVE-2024-30478.md): WordPress Announcement & Notification Banner – Bulletin plugin \<= 3.8.5 - SQL Injection vulnerability (CVSS 7.6, WordPress Announcement & Notification Banner Plugin – Bulle…)
- [CVE-2024-30510](https://cve.now/CVE-2024-30510.md): WordPress Salon booking system plugin \<= 9.5 - Arbitrary File Upload vulnerability (CVSS 10.0, Salon booking system)
- [CVE-2024-30500](https://cve.now/CVE-2024-30500.md): WordPress CubeWP plugin \<= 1.1.12 - Arbitrary File Upload vulnerability (CVSS 9.9, CubeWP – All-in-One Dynamic Content Framework)
- [CVE-2024-30430](https://cve.now/CVE-2024-30430.md): WordPress FluentCRM plugin \<= 2.8.44 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Email Newsletter Team - FluentCRM Fluent CRM)
- [CVE-2024-30429](https://cve.now/CVE-2024-30429.md): WordPress wp-forecast plugin \<= 9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hans Matzen wp-forecast)
- [CVE-2024-30428](https://cve.now/CVE-2024-30428.md): WordPress Contest Gallery plugin \<= 24.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-30427](https://cve.now/CVE-2024-30427.md): WordPress Spiffy Calendar plugin \<= 4.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-30426](https://cve.now/CVE-2024-30426.md): WordPress Hash Elements plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HashThemes Hash Elements)
- [CVE-2024-30425](https://cve.now/CVE-2024-30425.md): WordPress Beaver Builder plugin \<= 2.7.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Beaver Builder)
- [CVE-2024-30423](https://cve.now/CVE-2024-30423.md): WordPress Better Elementor Addons plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BetterAddons Better Elementor Addons)
- [CVE-2022-47153](https://cve.now/CVE-2022-47153.md): WordPress Jobeleon theme \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPJobBoard Jobeleon Theme)
- [CVE-2024-30456](https://cve.now/CVE-2024-30456.md): WordPress WPCS – WordPress Currency Switcher Professional plugin \<=1.2.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 WPCS)
- [CVE-2024-30457](https://cve.now/CVE-2024-30457.md): WordPress MDTF plugin \<= 1.3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-30458](https://cve.now/CVE-2024-30458.md): WordPress FOX – Currency Switcher Professional for WooCommerce plugin \<= 1.4.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 WOOCS – WooCommerce Currency Switcher)
- [CVE-2024-30483](https://cve.now/CVE-2024-30483.md): WordPress Sponsors plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Simple Sponsorships Sponsors)
- [CVE-2024-30503](https://cve.now/CVE-2024-30503.md): WordPress Mailster plugin \<= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EverPress Mailster)
- [CVE-2024-30519](https://cve.now/CVE-2024-30519.md): WordPress Lordicon Animated Icons plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lordicon Animated Icons)
- [CVE-2024-30520](https://cve.now/CVE-2024-30520.md): WordPress Carousel Anything For WPBakery Page Builder plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Labib Ahmed Carousel Anything For WPBakery Page Builder)
- [CVE-2024-3078](https://cve.now/CVE-2024-3078.md): Qdrant Full Snapshot REST API snapshots.rs path traversal (CVSS 5.5, Qdrant)
- [CVE-2023-6191](https://cve.now/CVE-2023-6191.md): SQLi in WebPDKS (CVSS 9.8, Egehan Security WebPDKS)
- [CVE-2023-6047](https://cve.now/CVE-2023-6047.md): Reflected XSS in Algoritim E-commerce Software (CVSS 6.1, Algoritim E-commerce Software)
- [CVE-2024-23449](https://cve.now/CVE-2024-23449.md): Elasticsearch Uncaught Exception (CVSS 4.3, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-2848](https://cve.now/CVE-2024-2848.md): Responsive \<= 5.0.2 - Missing Authorization to HTML Injection (CVSS 7.5, cyberchimps Responsive)
- [CVE-2024-3061](https://cve.now/CVE-2024-3061.md): HUSKY – Products Filter Professional for WooCommerce \<= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion (CVSS 7.2, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2023-52629](https://cve.now/CVE-2023-52629.md): sh: push-switch: Reorder cleanup operations to avoid use-after-free bug (CVSS 8.4, Linux)
- [CVE-2024-2411](https://cve.now/CVE-2024-2411.md): MasterStudy LMS \<= 3.3.0 - Unauthenticated Local File Inclusion via modal (CVSS 9.8, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-2409](https://cve.now/CVE-2024-2409.md): MasterStudy LMS \<= 3.3.1 - Unauthenticated Privilege Escalation via stm\_lms\_register AJAX Action (CVSS 9.8, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-2250](https://cve.now/CVE-2024-2250.md): 130+ Widgets | Best Addons For Elementor – FREE \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-2280](https://cve.now/CVE-2024-2280.md): Better Elementor Addons \<= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links (CVSS 6.4, wpdive Better Addons for Elementor)
- [CVE-2024-0956](https://cve.now/CVE-2024-0956.md): WP ERP \<= 1.13.0 - Authenticated (AccountingManager+) SQL Injection (CVSS 4.9, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-1872](https://cve.now/CVE-2024-1872.md): Button \<= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button\_shortcode (CVSS 8.8, burgersoftware Button)
- [CVE-2024-2964](https://cve.now/CVE-2024-2964.md): Pocket News Generator \<= 0.2.0 - Cross-Site Request Forgery to Settings Update (CVSS 5.4, marubon Pocket News Generator)
- [CVE-2024-0609](https://cve.now/CVE-2024-0609.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-0608](https://cve.now/CVE-2024-0608.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-2108](https://cve.now/CVE-2024-2108.md): Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \<= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 4.6, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-2476](https://cve.now/CVE-2024-2476.md): OceanWP \<= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion (CVSS 4.3, OceanWP)
- [CVE-2024-0913](https://cve.now/CVE-2024-0913.md): WP ERP \<= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection (CVSS 7.2, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-1858](https://cve.now/CVE-2024-1858.md): Lightbox slider – Responsive Lightbox Gallery \<= 1.9.9 - Authenticated (Contributor+) PHP Object Injection (CVSS 5.4, weblizar Lightbox slider – Responsive Lightbox Gallery)
- [CVE-2024-2116](https://cve.now/CVE-2024-2116.md): Christmas Greetings \<= 1.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, technocrackers Christmas Greetings)
- [CVE-2024-2113](https://cve.now/CVE-2024-2113.md): Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress \<= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export (CVSS 4.3, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-2970](https://cve.now/CVE-2024-2970.md): News Wall \<= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, tsina News Wall)
- [CVE-2024-2969](https://cve.now/CVE-2024-2969.md): WP-Eggdrop \<= 0.1 - Cross-Site Request Forgery to Settings Update (CVSS 5.4, backie WP-Eggdrop)
- [CVE-2024-2963](https://cve.now/CVE-2024-2963.md): Pocket News Generator \<= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, marubon Pocket News Generator)
- [CVE-2024-2968](https://cve.now/CVE-2024-2968.md): WP-Eggdrop \<= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, backie WP-Eggdrop)
- [CVE-2024-2844](https://cve.now/CVE-2024-2844.md): Easy Appointments \<= 3.11.18 - Insufficient Authorization (CVSS 4.3, easyappointments Easy Appointments)
- [CVE-2024-2842](https://cve.now/CVE-2024-2842.md): Easy Appointments \<= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, easyappointments Easy Appointments)
- [CVE-2024-2936](https://cve.now/CVE-2024-2936.md): Sydney Toolbox \<= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_id (CVSS 6.4, smub Sydney Toolbox)
- [CVE-2024-3077](https://cve.now/CVE-2024-3077.md): Bluetooth: integer underflow in gatt\_find\_info\_rsp (CVSS 6.8, zephyrproject-rtos Zephyr)
- [CVE-2024-1729](https://cve.now/CVE-2024-1729.md): Timing Attack Vulnerability in gradio-app/gradio (CVSS 5.9, gradio-app/gradio · gradio)
- [CVE-2024-2841](https://cve.now/CVE-2024-2841.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-2475](https://cve.now/CVE-2024-2475.md): Media Library Assistant \<= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla\_gallery Shortcode (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2023-49231](https://cve.now/CVE-2023-49231.md): An authentication bypass vulnerability was found in Stilog Visual Planning 8. (CVSS 9.8)
- [CVE-2023-49232](https://cve.now/CVE-2023-49232.md): An authentication bypass vulnerability was found in Stilog Visual Planning 8. (CVSS 9.8)
- [CVE-2023-49234](https://cve.now/CVE-2023-49234.md): An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. (CVSS 6.3)
- [CVE-2024-27619](https://cve.now/CVE-2024-27619.md): Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. (CVSS 7.3)
- [CVE-2024-28405](https://cve.now/CVE-2024-28405.md): SEMCMS 4.8 is vulnerable to Incorrect Access Control. (CVSS 7.2)
- [CVE-2024-28960](https://cve.now/CVE-2024-28960.md): An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. (CVSS 8.2)
- [CVE-2024-29640](https://cve.now/CVE-2024-29640.md): An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parame (CVSS 9.8, aliyundrive-webdav)
- [CVE-2024-29667](https://cve.now/CVE-2024-29667.md): SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate pri (CVSS 9.8)
- [CVE-2024-29686](https://cve.now/CVE-2024-29686.md): Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted p (CVSS 7.2, wintercms/winter)
- [CVE-2024-30613](https://cve.now/CVE-2024-30613.md): Tenda AC15 v15.03.05.18 has a stack overflow vulnerability in the time parameter from the setSmartPowerManagement function. (CVSS 4.3)
- [CVE-2024-30622](https://cve.now/CVE-2024-30622.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the mitInterface parameter from fromAddressNat function. (CVSS 9.8)
- [CVE-2024-30623](https://cve.now/CVE-2024-30623.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromDhcpListClient function. (CVSS 6.5)
- [CVE-2024-30624](https://cve.now/CVE-2024-30624.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function. (CVSS 8.8)
- [CVE-2024-30625](https://cve.now/CVE-2024-30625.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function. (CVSS 8.0)
- [CVE-2024-30626](https://cve.now/CVE-2024-30626.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedEndTime parameter from setSchedWifi function. (CVSS 8.0)
- [CVE-2024-30627](https://cve.now/CVE-2024-30627.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the deviceId parameter from saveParentControlInfo function. (CVSS 8.8)
- [CVE-2024-30628](https://cve.now/CVE-2024-30628.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the page parameter from fromAddressNat function. (CVSS 9.8)
- [CVE-2024-30629](https://cve.now/CVE-2024-30629.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the list1 parameter from fromDhcpListClient function. (CVSS 5.7)
- [CVE-2024-30630](https://cve.now/CVE-2024-30630.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the time parameter from saveParentControlInfo function. (CVSS 9.8)
- [CVE-2024-30631](https://cve.now/CVE-2024-30631.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedStartTime parameter from setSchedWifi function. (CVSS 4.3)
- [CVE-2024-30632](https://cve.now/CVE-2024-30632.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security\_5g parameter from formWifiBasicSet function. (CVSS 6.5)
- [CVE-2024-30633](https://cve.now/CVE-2024-30633.md): Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function. (CVSS 6.5)
- [CVE-2024-30634](https://cve.now/CVE-2024-30634.md): Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function. (CVSS 8.0)
- [CVE-2024-30635](https://cve.now/CVE-2024-30635.md): Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function. (CVSS 9.8)
- [CVE-2024-30636](https://cve.now/CVE-2024-30636.md): Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function. (CVSS 6.5)
- [CVE-2024-30637](https://cve.now/CVE-2024-30637.md): Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter. (CVSS 8.8)
- [CVE-2024-30638](https://cve.now/CVE-2024-30638.md): Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function. (CVSS 4.3)
- [CVE-2024-30639](https://cve.now/CVE-2024-30639.md): Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function. (CVSS 6.5)
- [CVE-2024-30645](https://cve.now/CVE-2024-30645.md): Tenda AC15V1.0 V15.03.20\_multi has a command injection vulnerability via the deviceName parameter. (CVSS 8.0)
- [CVE-2024-31032](https://cve.now/CVE-2024-31032.md): An issue in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 allows a remote attacker to execute arbitra (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.