# CVEs published 2024-03-31

66 CVEs were published on March 31, 2024: 5 critical, 22 high. Days are UTC.

- [CVE-2014-125110](https://cve.now/CVE-2014-125110.md): wp-file-upload Plugin wfu\_ajaxactions.php wfu\_ajax\_action\_callback cross site scripting (CVSS 3.5, wp-file-upload Plugin)
- [CVE-2024-30524](https://cve.now/CVE-2024-30524.md): WordPress PDF Viewer for Elementor plugin \<= 2.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RedLettuce Plugins PDF Viewer for Elementor)
- [CVE-2024-30530](https://cve.now/CVE-2024-30530.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sonaar Music MP3 Audio Player for Music, Radio & Podcast by…)
- [CVE-2024-30548](https://cve.now/CVE-2024-30548.md): WordPress underConstruction plugin \<= 1.21 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Noah Kagan underConstruction)
- [CVE-2024-30549](https://cve.now/CVE-2024-30549.md): WordPress Contact Forms by Cimatti plugin \<= 1.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Contact Forms by Cimatti)
- [CVE-2024-30550](https://cve.now/CVE-2024-30550.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpdevart Responsive Image Gallery, Gallery Album)
- [CVE-2024-30551](https://cve.now/CVE-2024-30551.md): WordPress Sticky Anything plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Toast Plugins Sticky Anything)
- [CVE-2024-30552](https://cve.now/CVE-2024-30552.md): WordPress Responsive flipbook plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wppdf.org Responsive flipbook)
- [CVE-2024-30553](https://cve.now/CVE-2024-30553.md): WordPress WP Twitter Mega Fan Box Widget plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Joby Joseph WP Twitter Mega Fan Box Widget)
- [CVE-2024-30554](https://cve.now/CVE-2024-30554.md): WordPress DD Rating plugin \<= 1.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Wouter Dijkstra DD Rating)
- [CVE-2024-30555](https://cve.now/CVE-2024-30555.md): WordPress Ultimate Social Comments plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sayan Datta Ultimate Social Comments – Email Notification &…)
- [CVE-2024-30556](https://cve.now/CVE-2024-30556.md): WordPress Mighty Classic Pros And Cons plugin \<= 2.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MightyThemes Mighty Classic Pros And Cons)
- [CVE-2024-30557](https://cve.now/CVE-2024-30557.md): WordPress Aesop Story Engine plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aesopinteractive Aesop Story Engine)
- [CVE-2024-30558](https://cve.now/CVE-2024-30558.md): WordPress Add Shortcodes Actions And Filters plugin \<= 2.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michael Simpson Add Shortcodes Actions And Filters)
- [CVE-2024-30559](https://cve.now/CVE-2024-30559.md): WordPress Spin 360 deg and 3D Model Viewer plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maurice Spin 360 deg and 3D Model Viewer)
- [CVE-2024-30561](https://cve.now/CVE-2024-30561.md): WordPress Appointment Calendar plugin \<= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Scientech It Solution Appointment Calendar)
- [CVE-2024-31084](https://cve.now/CVE-2024-31084.md): WordPress Weekly Class Schedule plugin \<= 3.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pulsar Web Design Weekly Class Schedule)
- [CVE-2024-31085](https://cve.now/CVE-2024-31085.md): WordPress Post-Plugin Library plugin \<= 2.6.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rob Marsh, SJ Post-Plugin Library)
- [CVE-2024-31087](https://cve.now/CVE-2024-31087.md): WordPress pageMash plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Joel Starnes pageMash \> Page Management)
- [CVE-2024-31089](https://cve.now/CVE-2024-31089.md): WordPress Platinum SEO plugin \<= 2.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Techblissonline.com (Rajesh) Platinum SEO)
- [CVE-2024-31090](https://cve.now/CVE-2024-31090.md): WordPress Hacklog Down As PDF plugin \<= 2.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, 荒野无灯 Hacklog Down As PDF)
- [CVE-2024-31091](https://cve.now/CVE-2024-31091.md): WordPress Custom Field Bulk Editor plugin \<= 1.9.1 - Cross Site Scripting vulnerability (CVSS 7.1, SparkWeb Interactive Custom Field Bulk Editor)
- [CVE-2024-31092](https://cve.now/CVE-2024-31092.md): WordPress Comic Easel plugin \<= 1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Philip M. Hofer (Frumph) Comic Easel)
- [CVE-2024-31097](https://cve.now/CVE-2024-31097.md): WordPress SEO Title Tag plugin \<= 3.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stephan Spencer SEO Title Tag)
- [CVE-2024-31101](https://cve.now/CVE-2024-31101.md): WordPress AI Twitter Feeds (Twitter widget & shortcode) plugin \<= 2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, August Infotech AI Twitter Feeds)
- [CVE-2024-31102](https://cve.now/CVE-2024-31102.md): WordPress Prenotazioni plugin \<= 1.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Scimone Ignazio Prenotazioni)
- [CVE-2024-31103](https://cve.now/CVE-2024-31103.md): WordPress Kanban Boards for WordPress plugin \<= 2.5.21 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kanban for WordPress Kanban Boards for WordPress)
- [CVE-2024-31104](https://cve.now/CVE-2024-31104.md): WordPress GetResponse for WordPress plugin \<= 5.5.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GetResponse for WordPress)
- [CVE-2024-31106](https://cve.now/CVE-2024-31106.md): WordPress Yoo Slider – Image Slider & Video Slider plugin \<= 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yooslider Yoo Slider)
- [CVE-2024-31107](https://cve.now/CVE-2024-31107.md): WordPress OpenID plugin \<= 3.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DiSo Development Team OpenID)
- [CVE-2024-31108](https://cve.now/CVE-2024-31108.md): WordPress iFlyChat plugin \<= 4.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, iFlyChat Team iFlyChat – WordPress Chat)
- [CVE-2024-31110](https://cve.now/CVE-2024-31110.md): WordPress Contact Form 7 Newsletter plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Katz Web Services Contact Form 7 Newsletter)
- [CVE-2024-31112](https://cve.now/CVE-2024-31112.md): WordPress Convert Post Types plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stephanie Leary Convert Post Types)
- [CVE-2024-31117](https://cve.now/CVE-2024-31117.md): WordPress WooCommerce Bookings Calendar plugin \<= 1.0.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Moises Heberle WooCommerce Bookings Calendar)
- [CVE-2024-31120](https://cve.now/CVE-2024-31120.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdevart Responsive Image Gallery, Gallery Album)
- [CVE-2024-31121](https://cve.now/CVE-2024-31121.md): WordPress HeartThis plugin \<= 0.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Site Care HeartThis)
- [CVE-2024-31122](https://cve.now/CVE-2024-31122.md): WordPress User Rights Access Manager plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, Prism IT Systems User Rights Access Manager)
- [CVE-2024-31123](https://cve.now/CVE-2024-31123.md): WordPress SpiderFAQ plugin \<= 1.3.2 - Cross Site Scripting vulnerability (CVSS 7.1, WebDorado SpiderFAQ)
- [CVE-2024-30526](https://cve.now/CVE-2024-30526.md): WordPress Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin \<= 6.5.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Easy Social Feed)
- [CVE-2024-30536](https://cve.now/CVE-2024-30536.md): WordPress Slugs Manager plugin \<= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPFactory Slugs Manager)
- [CVE-2024-30541](https://cve.now/CVE-2024-30541.md): WordPress LWS Optimize plugin \<= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, LWS Optimize)
- [CVE-2024-31096](https://cve.now/CVE-2024-31096.md): WordPress Nictitate theme \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, kopatheme Nictitate)
- [CVE-2024-31100](https://cve.now/CVE-2024-31100.md): WordPress Popup Cart Lite for WooCommerce plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Festi-Team Popup Cart Lite for WooCommerce)
- [CVE-2024-30543](https://cve.now/CVE-2024-30543.md): WordPress Whizzy plugin \<= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, UPQODE Whizzy)
- [CVE-2024-31095](https://cve.now/CVE-2024-31095.md): WordPress Thumbs Rating plugin \<= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Ricard Torres Thumbs Rating)
- [CVE-2024-30489](https://cve.now/CVE-2024-30489.md): WordPress WP Cost Estimation & Payment Forms Builder plugin \<= 10.1.75 - SQL Injection vulnerability (CVSS 8.5, loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2024-30535](https://cve.now/CVE-2024-30535.md): WordPress Easy Form Builder plugin \<= 3.7.4 - SQL Injection vulnerability (CVSS 8.5, WhiteStudio Easy Form Builder)
- [CVE-2024-31116](https://cve.now/CVE-2024-31116.md): WordPress 10Web Map Builder for Google Maps plugin \<= 1.0.74 - SQL Injection vulnerability (CVSS 7.6, 10Web Map Builder for Google Maps)
- [CVE-2024-30523](https://cve.now/CVE-2024-30523.md): WordPress Paid Memberships Pro – Mailchimp Add On plugin \<= 2.3.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, Paid Memberships Pro – Mailchimp Add On)
- [CVE-2024-30533](https://cve.now/CVE-2024-30533.md): WordPress Layouts for Elementor plugin \< 1.8 - Arbitrary File Upload vulnerability (CVSS 7.5, Techeshta Layouts for Elementor)
- [CVE-2024-31114](https://cve.now/CVE-2024-31114.md): WordPress Shortcode Addons \<= 3.2.5 - Arbitrary File Upload vulnerability (CVSS 9.1, biplob018 Shortcode Addons)
- [CVE-2024-31115](https://cve.now/CVE-2024-31115.md): WordPress Chauffeur Taxi Booking System for WordPress plugin \<= 7.2 - Arbitrary File Upload vulnerability (CVSS 10.0, QuanticaLabs Chauffeur Taxi Booking System for WordPress)
- [CVE-2024-31094](https://cve.now/CVE-2024-31094.md): WordPress Filter Custom Fields & Taxonomies Light plugin \<= 1.05 - PHP Object Injection vulnerability (CVSS 8.5, Filter Custom Fields & Taxonomies Light)
- [CVE-2023-50311](https://cve.now/CVE-2023-50311.md): IBM CICS Transaction Gateway for Multiplatforms information disclosure (CVSS 3.1, IBM CICS Transaction Gateway for Multiplatforms)
- [CVE-2023-50959](https://cve.now/CVE-2023-50959.md): IBM Cloud Pak for Business Automation information disclosure (CVSS 5.3, IBM Cloud Pak for Business Automation)
- [CVE-2024-22353](https://cve.now/CVE-2024-22353.md): IBM WebSphere Application Server Liberty denial of service (CVSS 5.9, IBM WebSphere Application Server Liberty)
- [CVE-2024-25027](https://cve.now/CVE-2024-25027.md): IBM Security Verify Access Container information disclosure (CVSS 6.2, IBM Security Verify Access Docker)
- [CVE-2020-36828](https://cve.now/CVE-2020-36828.md): DiscuzX install\_function.php show\_next\_step cross site scripting (CVSS 3.5, DiscuzX)
- [CVE-2017-20191](https://cve.now/CVE-2017-20191.md): Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting (CVSS 3.5, Zimbra zm-admin-ajax)
- [CVE-2015-10131](https://cve.now/CVE-2015-10131.md): chrisy TFO Graphviz Plugin tfo-graphviz-admin.php admin\_page cross site scripting (CVSS 3.5, chrisy TFO Graphviz Plugin)
- [CVE-2024-3118](https://cve.now/CVE-2024-3118.md): Dreamer CMS Attachment permission (CVSS 6.3, Dreamer CMS)
- [CVE-2023-46808](https://cve.now/CVE-2023-46808.md): An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. (CVSS 9.9, Ivanti ITSM)
- [CVE-2023-41724](https://cve.now/CVE-2023-41724.md): A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the (CVSS 9.6, Ivanti Sentry)
- [CVE-2024-3117](https://cve.now/CVE-2024-3117.md): YouDianCMS ChannelAction.class.php unrestricted upload (CVSS 4.7, YouDianCMS)
- [CVE-2023-51803](https://cve.now/CVE-2023-51803.md): LinuxServer.io Heimdall before 2.5.7 does not prevent use of icons that have non-image data such as the "\<?php ?\>" substring. (CVSS 9.8)
- [CVE-2024-27609](https://cve.now/CVE-2024-27609.md): Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel. (CVSS 6.5, org.bonitasoft.console:bonita-web-server · org.bonitasoft.p…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.