# CVEs published 2024-03-30 26 CVEs were published on March 30, 2024: 2 critical, 6 high. Days are UTC. - [CVE-2024-1522](https://cve.now/CVE-2024-1522.md): Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui (CVSS 8.8, parisneo/lollms-webui) - [CVE-2024-3091](https://cve.now/CVE-2024-3091.md): PHPGurukul Emergency Ambulance Hiring Portal Search Request Page search.php cross site scripting (CVSS 2.4, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-3090](https://cve.now/CVE-2024-3090.md): PHPGurukul Emergency Ambulance Hiring Portal Add Ambulance Page add-ambulance.php cross site scripting (CVSS 2.4, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-3089](https://cve.now/CVE-2024-3089.md): PHPGurukul Emergency Ambulance Hiring Portal Manage Ambulance Page manage-ambulance.php cross-site request forgery (CVSS 4.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-3018](https://cve.now/CVE-2024-3018.md): Essential Addons for Elementor \<= 5.9.13 - Authenticated (Author+) PHP Object Injection via error\_resetpassword (CVSS 8.8, wpdevteam Essential Addons for Elementor – Popular Elemento…) - [CVE-2024-3088](https://cve.now/CVE-2024-3088.md): PHPGurukul Emergency Ambulance Hiring Portal Forgot Password Page forgot-password.php sql injection (CVSS 7.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-3087](https://cve.now/CVE-2024-3087.md): PHPGurukul Emergency Ambulance Hiring Portal Ambulance Tracking Page ambulance-tracking.php sql injection (CVSS 7.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-2491](https://cve.now/CVE-2024-2491.md): PowerPack Addons for Elementor \<= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via \*\_html\_tag\* (CVSS 6.4, ideaboxcreations PowerPack Addons for Elementor) - [CVE-2024-3086](https://cve.now/CVE-2024-3086.md): PHPGurukul Emergency Ambulance Hiring Portal Ambulance Tracking Page ambulance-tracking.php cross site scripting (CVSS 4.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-3085](https://cve.now/CVE-2024-3085.md): PHPGurukul Emergency Ambulance Hiring Portal Admin Login Page login.php sql injection (CVSS 7.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-2948](https://cve.now/CVE-2024-2948.md): Favorites \<= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, kylephillips Favorites) - [CVE-2024-3084](https://cve.now/CVE-2024-3084.md): PHPGurukul Emergency Ambulance Hiring Portal Hire an Ambulance Page cross site scripting (CVSS 4.3, PHPGurukul Emergency Ambulance Hiring Portal) - [CVE-2024-2140](https://cve.now/CVE-2024-2140.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget (CVSS 6.4, brainstormforce Ultimate Addons for Beaver Builder – Lite) - [CVE-2024-2142](https://cve.now/CVE-2024-2142.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget (CVSS 6.4, brainstormforce Ultimate Addons for Beaver Builder – Lite) - [CVE-2024-2141](https://cve.now/CVE-2024-2141.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, brainstormforce Ultimate Addons for Beaver Builder – Lite) - [CVE-2024-2144](https://cve.now/CVE-2024-2144.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget (CVSS 6.4, brainstormforce Ultimate Addons for Beaver Builder – Lite) - [CVE-2024-2143](https://cve.now/CVE-2024-2143.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget (CVSS 6.4, brainstormforce Ultimate Addons for Beaver Builder – Lite) - [CVE-2024-1238](https://cve.now/CVE-2024-1238.md): ElementsKit Elementor addons \<= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…) - [CVE-2024-1051](https://cve.now/CVE-2024-1051.md): List category posts \<= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, fernandobt List category posts) - [CVE-2024-2086](https://cve.now/CVE-2024-2086.md): Integrate Google Drive \<= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export (CVSS 10.0, princeahmed File Manager for Google Drive – Integrate Googl…) - [CVE-2024-2794](https://cve.now/CVE-2024-2794.md): Gutenberg Block Editor Toolkit – EditorsKit \<= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, munirkamal Gutenberg Block Editor Toolkit – EditorsKit) - [CVE-2024-0367](https://cve.now/CVE-2024-0367.md): Unlimited Elements For Elementor \<= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link (CVSS 6.4, unitecms Unlimited Elements For Elementor) - [CVE-2024-2047](https://cve.now/CVE-2024-2047.md): ElementsKit Elementor addons \<= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render\_raw (CVSS 8.8, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…) - [CVE-2024-1692](https://cve.now/CVE-2024-1692.md): BoldGrid Easy SEO – Simple and Effective SEO \<= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description (CVSS 6.4, BoldGrid Easy SEO – Simple and Effective SEO) - [CVE-2024-28288](https://cve.now/CVE-2024-28288.md): Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vul (CVSS 9.8) - [CVE-2024-29278](https://cve.now/CVE-2024-29278.md): funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ." (CVSS 6.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-03-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.