CVEs published March 31, 2024
66 CVEs were published on March 31, 2024: 5 critical, 22 high.
- Published
- 66
- Critical
- 5
- High
- 22
- Medium
- 34
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- wpdevart Responsive Image Gallery, Gallery Album
- 2
- 10Web Map Builder for Google Maps
- 1
- Aesopinteractive Aesop Story Engine
- 1
- August Infotech AI Twitter Feeds
- 1
- biplob018 Shortcode Addons
- 1
- chrisy TFO Graphviz Plugin
- 1
- Contact Forms by Cimatti
- 1
- DiscuzX
- 1
- DiSo Development Team OpenID
- 1
- Dreamer CMS
- 1
Critical 5
- CVE-2024-31114WordPress Shortcode Addons <= 3.2.5 - Arbitrary File Upload vulnerabilitybiplob018 Shortcode Addons
- CVE-2024-31115WordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerabilityQuanticaLabs Chauffeur Taxi Booking System for WordPress
- CVE-2023-46808An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server.Ivanti ITSM
- CVE-2023-41724A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the Ivanti Sentry
- CVE-2023-51803LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "<?php ?>" substring.
High 22
- CVE-2024-30550WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdevart Responsive Image Gallery, Gallery Album
- CVE-2024-30551WordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerabilityToast Plugins Sticky Anything
- CVE-2024-30558WordPress Add Shortcodes Actions And Filters plugin <= 2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityMichael Simpson Add Shortcodes Actions And Filters
- CVE-2024-30561WordPress Appointment Calendar plugin <= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerabilityScientech It Solution Appointment Calendar
- CVE-2024-31084WordPress Weekly Class Schedule plugin <= 3.19 - Reflected Cross Site Scripting (XSS) vulnerabilityPulsar Web Design Weekly Class Schedule
- CVE-2024-31085WordPress Post-Plugin Library plugin <= 2.6.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRob Marsh, SJ Post-Plugin Library
- CVE-2024-31087WordPress pageMash plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityJoel Starnes pageMash > Page Management
- CVE-2024-31090WordPress Hacklog Down As PDF plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerability荒野无灯 Hacklog Down As PDF
- CVE-2024-31091WordPress Custom Field Bulk Editor plugin <= 1.9.1 - Cross Site Scripting vulnerabilitySparkWeb Interactive Custom Field Bulk Editor
- CVE-2024-31092WordPress Comic Easel plugin <= 1.15 - Cross Site Scripting (XSS) vulnerabilityPhilip M. Hofer (Frumph) Comic Easel
- CVE-2024-31097WordPress SEO Title Tag plugin <= 3.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityStephan Spencer SEO Title Tag
- CVE-2024-31103WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Reflected Cross Site Scripting (XSS) vulnerabilityKanban for WordPress Kanban Boards for WordPress
- CVE-2024-31106WordPress Yoo Slider – Image Slider & Video Slider plugin <= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityYooslider Yoo Slider
- CVE-2024-31107WordPress OpenID plugin <= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDiSo Development Team OpenID
- CVE-2024-31110WordPress Contact Form 7 Newsletter plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityKatz Web Services Contact Form 7 Newsletter
- CVE-2024-31112WordPress Convert Post Types plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityStephanie Leary Convert Post Types
- CVE-2024-31123WordPress SpiderFAQ plugin <= 1.3.2 - Cross Site Scripting vulnerabilityWebDorado SpiderFAQ
- CVE-2024-30489WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - SQL Injection vulnerabilityloopus WP Cost Estimation & Payment Forms Builder
- CVE-2024-30535WordPress Easy Form Builder plugin <= 3.7.4 - SQL Injection vulnerabilityWhiteStudio Easy Form Builder
- CVE-2024-31116WordPress 10Web Map Builder for Google Maps plugin <= 1.0.74 - SQL Injection vulnerability10Web Map Builder for Google Maps
- CVE-2024-30533WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerabilityTecheshta Layouts for Elementor
- CVE-2024-31094WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - PHP Object Injection vulnerabilityFilter Custom Fields & Taxonomies Light
Medium, low and unrated 39
- CVE-2014-125110wp-file-upload Plugin wfu_ajaxactions.php wfu_ajax_action_callback cross site scriptingwp-file-upload Plugin
- CVE-2024-30524WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerabilityRedLettuce Plugins PDF Viewer for Elementor
- CVE-2024-30530WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Cross Site Scripting (XSS) vulnerabilitySonaar Music MP3 Audio Player for Music, Radio & Podcast by…
- CVE-2024-30548WordPress underConstruction plugin <= 1.21 - Cross Site Scripting (XSS) vulnerabilityNoah Kagan underConstruction
- CVE-2024-30549WordPress Contact Forms by Cimatti plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerabilityContact Forms by Cimatti
- CVE-2024-30552WordPress Responsive flipbook plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilitywppdf.org Responsive flipbook
- CVE-2024-30553WordPress WP Twitter Mega Fan Box Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityJoby Joseph WP Twitter Mega Fan Box Widget
- CVE-2024-30554WordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerabilityWouter Dijkstra DD Rating
- CVE-2024-30555WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilitySayan Datta Ultimate Social Comments – Email Notification &…
- CVE-2024-30556WordPress Mighty Classic Pros And Cons plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityMightyThemes Mighty Classic Pros And Cons
- CVE-2024-30557WordPress Aesop Story Engine plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityAesopinteractive Aesop Story Engine
- CVE-2024-30559WordPress Spin 360 deg and 3D Model Viewer plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityMaurice Spin 360 deg and 3D Model Viewer
- CVE-2024-31089WordPress Platinum SEO plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityTechblissonline.com (Rajesh) Platinum SEO
- CVE-2024-31101WordPress AI Twitter Feeds (Twitter widget & shortcode) plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityAugust Infotech AI Twitter Feeds
- CVE-2024-31102WordPress Prenotazioni plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityScimone Ignazio Prenotazioni
- CVE-2024-31104WordPress GetResponse for WordPress plugin <= 5.5.33 - Cross Site Scripting (XSS) vulnerabilityGetResponse for WordPress
- CVE-2024-31108WordPress iFlyChat plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerabilityiFlyChat Team iFlyChat – WordPress Chat
- CVE-2024-31117WordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerabilityMoises Heberle WooCommerce Bookings Calendar
- CVE-2024-31120WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitywpdevart Responsive Image Gallery, Gallery Album
- CVE-2024-31121WordPress HeartThis plugin <= 0.1.0 - Cross Site Scripting (XSS) vulnerabilityWP Site Care HeartThis
- CVE-2024-31122WordPress User Rights Access Manager plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityPrism IT Systems User Rights Access Manager
- CVE-2024-30526WordPress Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin <= 6.5.6 - Cross Site Request Forgery (CSRF) vulnerabilityEasy Social Feed
- CVE-2024-30536WordPress Slugs Manager plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerabilityWPFactory Slugs Manager
- CVE-2024-30541WordPress LWS Optimize plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityLWS Optimize
- CVE-2024-31096WordPress Nictitate theme <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerabilitykopatheme Nictitate
- CVE-2024-31100WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilityFesti-Team Popup Cart Lite for WooCommerce
- CVE-2024-30543WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerabilityUPQODE Whizzy
- CVE-2024-31095WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerabilityRicard Torres Thumbs Rating
- CVE-2024-30523WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerabilityPaid Memberships Pro – Mailchimp Add On
- CVE-2023-50311IBM CICS Transaction Gateway for Multiplatforms information disclosureIBM CICS Transaction Gateway for Multiplatforms
- CVE-2023-50959IBM Cloud Pak for Business Automation information disclosureIBM Cloud Pak for Business Automation
- CVE-2024-22353IBM WebSphere Application Server Liberty denial of serviceIBM WebSphere Application Server Liberty
- CVE-2024-25027IBM Security Verify Access Container information disclosureIBM Security Verify Access Docker
- CVE-2020-36828DiscuzX install_function.php show_next_step cross site scriptingDiscuzX
- CVE-2017-20191Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scriptingZimbra zm-admin-ajax
- CVE-2015-10131chrisy TFO Graphviz Plugin tfo-graphviz-admin.php admin_page cross site scriptingchrisy TFO Graphviz Plugin
- CVE-2024-3118Dreamer CMS Attachment permissionDreamer CMS
- CVE-2024-3117YouDianCMS ChannelAction.class.php unrestricted uploadYouDianCMS
- CVE-2024-27609Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel.org.bonitasoft.console:bonita-web-server · org.bonitasoft.p…