# CVEs published 2024-04-24

130 CVEs were published on April 24, 2024: 9 critical, 48 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-26926](https://cve.now/CVE-2024-26926.md): binder: check offset alignment in binder\_get\_object() (CVSS 7.8, Linux)
- [CVE-2024-23527](https://cve.now/CVE-2024-23527.md): An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an una (CVSS 5.3, Ivanti Avalanche)
- [CVE-2024-29205](https://cve.now/CVE-2024-29205.md): An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti P (CVSS 7.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-26925](https://cve.now/CVE-2024-26925.md): netfilter: nf\_tables: release mutex after nft\_gc\_seq\_end from abort path (CVSS 7.8, Linux)
- [CVE-2024-26924](https://cve.now/CVE-2024-26924.md): netfilter: nft\_set\_pipapo: do not free live element (CVSS 7.8, Linux)
- [CVE-2024-26923](https://cve.now/CVE-2024-26923.md): af\_unix: Fix garbage collector racing against connect() (CVSS 7.8, Linux · :linux\_kernel:)
- [CVE-2023-20249](https://cve.now/CVE-2023-20249.md): A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, re (CVSS 5.4, Cisco TelePresence Management Suite)
- [CVE-2023-20248](https://cve.now/CVE-2023-20248.md): A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, re (CVSS 5.4, Cisco TelePresence Management Suite)
- [CVE-2024-20313](https://cve.now/CVE-2024-20313.md): A vulnerability in the OSPF version 2 (OSPFv2) feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2024-32879](https://cve.now/CVE-2024-32879.md): social-auth-app-django Improper Handling of Case Sensitivity vulnerability (CVSS 4.9, python-social-auth social-app-django · social-auth-app-djan…)
- [CVE-2024-20295](https://cve.now/CVE-2024-20295.md): A vulnerability in the CLI of the Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to perform comma (CVSS 8.8, Cisco Unified Computing System)
- [CVE-2024-20356](https://cve.now/CVE-2024-20356.md): A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote a (CVSS 8.7, Cisco Unified Computing System)
- [CVE-2024-20358](https://cve.now/CVE-2024-20358.md): A vulnerability in the Cisco Adaptive Security Appliance (ASA) restore functionality that is available in Cisco ASA Software and Cisco Firep (CVSS 6.0, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2024-4127](https://cve.now/CVE-2024-4127.md): Tenda W15E guestWifiRuleRefresh stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4126](https://cve.now/CVE-2024-4126.md): Tenda W15E SetSysTimeCfg formSetSysTime stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-32876](https://cve.now/CVE-2024-32876.md): NewPipe has potential security vulnerability when importing settings (CVSS 8.5, TeamNewPipe NewPipe)
- [CVE-2024-4125](https://cve.now/CVE-2024-4125.md): Tenda W15E setStaticRoute formSetStaticRoute stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4141](https://cve.now/CVE-2024-4141.md): Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check (CVSS 2.9, Xpdf)
- [CVE-2024-4124](https://cve.now/CVE-2024-4124.md): Tenda W15E SetRemoteWebManage formSetRemoteWebManage stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4123](https://cve.now/CVE-2024-4123.md): Tenda W15E SetPortMapping formSetPortMapping stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-20359](https://cve.now/CVE-2024-20359.md): A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adap (CVSS 6.0, KEV, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20353](https://cve.now/CVE-2024-20353.md): A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defens (CVSS 8.6, KEV, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-4122](https://cve.now/CVE-2024-4122.md): Tenda W15E setDebugCfg formSetDebugCfg stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4121](https://cve.now/CVE-2024-4121.md): Tenda W15E formQOSRuleDel stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4120](https://cve.now/CVE-2024-4120.md): Tenda W15E modifyIpMacBind formIPMacBindModify stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-0151](https://cve.now/CVE-2024-0151.md): Insufficient argument checking in Secure state Entry functions in software using Cortex-M Security Extensions (CMSE), that has been compiled (CVSS 6.5, Arm v8-M Security Extensions Requirements on Development To…)
- [CVE-2024-4119](https://cve.now/CVE-2024-4119.md): Tenda W15E delIpMacBind formIPMacBindDel stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2023-51477](https://cve.now/CVE-2023-51477.md): WordPress BuddyBoss Theme theme \<= 2.4.60 - Unauth. Arbitrary WordPress Settings Change vulnerability (CVSS 9.8, BUDDYBOSS DMCC BuddyBoss Theme)
- [CVE-2024-27791](https://cve.now/CVE-2024-27791.md): The issue was addressed with improved checks. (CVSS 5.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23228](https://cve.now/CVE-2024-23228.md): This issue was addressed through improved state management. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2024-23271](https://cve.now/CVE-2024-23271.md): A logic issue was addressed with improved checks. (CVSS 7.3, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2023-51472](https://cve.now/CVE-2023-51472.md): WordPress Checkout Mestres WP plugin \<= 7.1.9.7 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, Mestres do WP Checkout Mestres WP)
- [CVE-2024-3371](https://cve.now/CVE-2024-3371.md): Insufficient validation of external input in Compass may enable MITM attacks (CVSS 7.1, MongoDB Compass)
- [CVE-2024-4118](https://cve.now/CVE-2024-4118.md): Tenda W15E addIpMacBind formIPMacBindAdd stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2023-51471](https://cve.now/CVE-2023-51471.md): WordPress Checkout Mestres WP plugin \<= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerability (CVSS 8.2, Mestres do WP Checkout Mestres WP)
- [CVE-2023-51425](https://cve.now/CVE-2023-51425.md): WordPress Rencontre plugin \<= 3.10.1 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, Jacques Malgrange Rencontre – Dating Site)
- [CVE-2023-51405](https://cve.now/CVE-2023-51405.md): WordPress BookingPress plugin \<= 1.0.74 - Booking Price Manipulation vulnerability (CVSS 8.2, Repute Infosystems BookingPress)
- [CVE-2023-48763](https://cve.now/CVE-2023-48763.md): WordPress JetFormBuilder plugin \<= 3.1.4 - Content Injection vulnerability (CVSS 5.3, Crocoblock JetFormBuilder)
- [CVE-2024-4117](https://cve.now/CVE-2024-4117.md): Tenda W15E DelPortMapping formDelPortMapping stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-4116](https://cve.now/CVE-2024-4116.md): Tenda W15E DelDhcpRule formDelDhcpRule stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2023-47774](https://cve.now/CVE-2023-47774.md): WordPress Jetpack plugin \< 12.7 - Auth. Iframe Injection vulnerability (CVSS 5.4, Automattic Jetpack)
- [CVE-2023-47504](https://cve.now/CVE-2023-47504.md): WordPress Elementor plugin \<= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2023-32127](https://cve.now/CVE-2023-32127.md): WordPress Multi Rating plugin \<= 5.0.6 - Unauth Arbitrary rating value change (CVSS 5.3, Daniel Powney Multi Rating)
- [CVE-2023-31090](https://cve.now/CVE-2023-31090.md): WordPress Unlimited Elements For Elementor plugin \<= 1.5.60 - Unrestricted Zip Extraction vulnerability (CVSS 9.9, Unlimited Elements For Elementor)
- [CVE-2023-25790](https://cve.now/CVE-2023-25790.md): WordPress WoodMart theme \<= 7.0.4 - Unauth Arbitrary Shortcodes Injection (CVSS 5.3, xtemos WoodMart)
- [CVE-2024-32078](https://cve.now/CVE-2024-32078.md): WordPress FV Player plugin \<= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability (CVSS 4.1, Foliovision FV Flowplayer Video Player)
- [CVE-2024-32432](https://cve.now/CVE-2024-32432.md): WordPress Ovic Addon Toolkit plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 4.3, Ovic Team Ovic Addon Toolkit)
- [CVE-2024-4115](https://cve.now/CVE-2024-4115.md): Tenda W15E AddDnsForward formAddDnsForward stack-based overflow (CVSS 8.8, Tenda W15E)
- [CVE-2024-32675](https://cve.now/CVE-2024-32675.md): WordPress Order Limit for WooCommerce plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 6.5, Xfinity Soft Order Limit for WooCommerce)
- [CVE-2024-32677](https://cve.now/CVE-2024-32677.md): WordPress LoginPress Pro plugin \< 3.0.0 - Unauth. License Activation/Deactivation vulnerability (CVSS 6.5, LoginPress Pro)
- [CVE-2024-32678](https://cve.now/CVE-2024-32678.md): WordPress TrackShip for WooCommerce plugin \<= 1.7.5 - Broken Access Control vulnerability (CVSS 5.3, TrackShip for WooCommerce)
- [CVE-2024-32699](https://cve.now/CVE-2024-32699.md): WordPress YITH WooCommerce Compare plugin \<= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, YITHEMES YITH WooCommerce Compare)
- [CVE-2024-4114](https://cve.now/CVE-2024-4114.md): Tenda TX9 PowerSaveSet sub\_42C014 stack-based overflow (CVSS 8.8, Tenda TX9)
- [CVE-2024-4113](https://cve.now/CVE-2024-4113.md): Tenda TX9 SetSysTimeCfg sub\_42D4DC stack-based overflow (CVSS 8.8, Tenda TX9)
- [CVE-2024-32728](https://cve.now/CVE-2024-32728.md): WordPress Paid Membership Subscriptions plugin \<= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Cozmoslabs Paid Member Subscriptions)
- [CVE-2024-32773](https://cve.now/CVE-2024-32773.md): WordPress Royal Elementor Kit theme \<= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WP Royal Royal Elementor Kit)
- [CVE-2024-32793](https://cve.now/CVE-2024-32793.md): WordPress Paid Memberships Pro plugin \<= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Paid Memberships Pro)
- [CVE-2024-32794](https://cve.now/CVE-2024-32794.md): WordPress Paid Memberships Pro plugin \<= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Paid Memberships Pro)
- [CVE-2024-32795](https://cve.now/CVE-2024-32795.md): WordPress WPCal.io \<= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Revmakx WPCal.io – Easy Meeting Scheduler)
- [CVE-2024-32806](https://cve.now/CVE-2024-32806.md): WordPress Headline Analyzer plugin \<= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CoSchedule Headline Analyzer)
- [CVE-2024-32947](https://cve.now/CVE-2024-32947.md): WordPress WP ADA Compliance Check Basic plugin \<= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, AlumniOnline Web Services WP ADA Compliance Check Basic)
- [CVE-2024-32958](https://cve.now/CVE-2024-32958.md): WordPress Slash Admin plugin \<= 3.8.1 - CSRF to XSS vulnerability (CVSS 7.1, Giorgos Sarigiannidis Slash Admin)
- [CVE-2024-32872](https://cve.now/CVE-2024-32872.md): Umbraco Workflow's Backoffice users can execute arbitrary SQL (CVSS 5.5, Umbraco.Workflow.Issues · Umbraco.Workflow +1)
- [CVE-2023-25785](https://cve.now/CVE-2023-25785.md): WordPress WP Post Rating plugin \<= 2.5 - Vote Manipulation Vulnerability (CVSS 5.3, Shoaib Saleem WP Post Rating)
- [CVE-2023-23989](https://cve.now/CVE-2023-23989.md): WordPress RegistrationMagic plugin \<= 5.1.9.2 - Content Injection (CVSS 5.3, Metagauss RegistrationMagic)
- [CVE-2024-4112](https://cve.now/CVE-2024-4112.md): Tenda TX9 SetVirtualServerCfg sub\_42CB94 stack-based overflow (CVSS 8.8, Tenda TX9)
- [CVE-2024-4111](https://cve.now/CVE-2024-4111.md): Tenda TX9 SetLEDCfg sub\_42BD7C stack-based overflow (CVSS 8.8, Tenda TX9)
- [CVE-2024-28825](https://cve.now/CVE-2024-28825.md): Brute-force protection ineffective for some login methods (CVSS 5.9, Checkmk)
- [CVE-2023-23985](https://cve.now/CVE-2023-23985.md): WordPress Quiz Maker plugin \<= 6.3.9.4 - Content Spoofing (CVSS 3.7, Quiz Maker team Quiz Maker)
- [CVE-2023-23976](https://cve.now/CVE-2023-23976.md): WordPress RegistrationMagic plugin \<= 5.1.9.2 - Arbitrary Price Change (CVSS 7.5, Metagauss RegistrationMagic)
- [CVE-2022-45852](https://cve.now/CVE-2022-45852.md): WordPress WP-FormAssembly plugin \<= 2.0.5 - Auth. Arbitrary File Read vulnerability (CVSS 6.5, FormAssembly / Drew Buschhorn WP-FormAssembly)
- [CVE-2024-32954](https://cve.now/CVE-2024-32954.md): WordPress Newsletters plugin \<= 4.9.5 - Arbitrary File Upload vulnerability (CVSS 9.1, Tribulant Newsletters)
- [CVE-2024-32785](https://cve.now/CVE-2024-32785.md): WordPress The Pack Elementor addons plugin \<= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Webangon The Pack Elementor addons)
- [CVE-2024-32789](https://cve.now/CVE-2024-32789.md): WordPress Seers plugin \<= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Seers)
- [CVE-2024-32772](https://cve.now/CVE-2024-32772.md): WordPress ProfileGrid plugin \<= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2024-32808](https://cve.now/CVE-2024-32808.md): WordPress ProfileGrid plugin \<= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability (CVSS 5.4, Metagauss ProfileGrid)
- [CVE-2024-32823](https://cve.now/CVE-2024-32823.md): WordPress Rate My Post plugin \<= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, FeedbackWP Rate my Post – WP Rating System)
- [CVE-2024-32702](https://cve.now/CVE-2024-32702.md): WordPress ARForms plugin \<= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, reputeinfosystems ARForms)
- [CVE-2024-32707](https://cve.now/CVE-2024-32707.md): WordPress Image Slider plugin \<= 1.1.125 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, GhozyLab Image Slider Widget)
- [CVE-2024-32711](https://cve.now/CVE-2024-32711.md): WordPress myCred plugin \<= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saad Iqbal myCred)
- [CVE-2024-32721](https://cve.now/CVE-2024-32721.md): WordPress Jeg Elementor Kit plugin \<= 2.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jegtheme Jeg Elementor Kit)
- [CVE-2024-32722](https://cve.now/CVE-2024-32722.md): WordPress Coupon & Discount Code Reveal Button plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Coupon & Discount Code Reveal Button)
- [CVE-2024-32723](https://cve.now/CVE-2024-32723.md): WordPress Advanced Floating Content plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Code Tides Advanced Floating Content)
- [CVE-2024-32791](https://cve.now/CVE-2024-32791.md): WordPress Premium Addons for Elementor plugin \<= 4.10.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Addons for Elementor)
- [CVE-2024-32801](https://cve.now/CVE-2024-32801.md): WordPress Widget Post Slider plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ShapedPlugin Widget Post Slider)
- [CVE-2024-32815](https://cve.now/CVE-2024-32815.md): WordPress All-in-one Like Widget plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jeroen Peters All-in-one Like Widget)
- [CVE-2024-32833](https://cve.now/CVE-2024-32833.md): WordPress List Custom Taxonomy Widget plugin \<= 4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nick Halsey List Custom Taxonomy Widget)
- [CVE-2024-32834](https://cve.now/CVE-2024-32834.md): WordPress WooCommerce Shipping Label plugin \<= 2.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WebToffee WooCommerce Shipping Label)
- [CVE-2024-32950](https://cve.now/CVE-2024-32950.md): WordPress WP Media Category Management plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DeBAAT WP Media Category Management)
- [CVE-2024-32952](https://cve.now/CVE-2024-32952.md): WordPress Max Addons Pro for Bricks plugin \<= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BloomPixel Max Addons Pro for Bricks)
- [CVE-2024-32956](https://cve.now/CVE-2024-32956.md): WordPress RomethemeKit For Elementor plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rometheme RTMKit)
- [CVE-2024-32706](https://cve.now/CVE-2024-32706.md): WordPress ARForms plugin \<= 6.4 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, reputeinfosystems ARForms)
- [CVE-2024-32709](https://cve.now/CVE-2024-32709.md): WordPress WP-Recall plugin \<= 16.26.5 - SQL Injection vulnerability (CVSS 9.3, Plechev Andrey WP-Recall)
- [CVE-2024-28977](https://cve.now/CVE-2024-28977.md): Dell Repository Manager, versions 3.4.2 through 3.4.4,contains a Path Traversal vulnerability in logger module. (CVSS 3.3, Dell Repository Manager)
- [CVE-2024-32710](https://cve.now/CVE-2024-32710.md): WordPress WP-Recall plugin \<= 16.26.5 - SQL Injection vulnerability (CVSS 8.5, Plechev Andrey WP-Recall)
- [CVE-2024-28976](https://cve.now/CVE-2024-28976.md): Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. (CVSS 8.8, Dell Repository Manager)
- [CVE-2024-32716](https://cve.now/CVE-2024-32716.md): WordPress StreamWeasels Twitch Integration plugin \<= 1.7.8 - API Sensitive Data Exposure vulnerability (CVSS 5.3, StreamWeasels Twitch Integration)
- [CVE-2024-32726](https://cve.now/CVE-2024-32726.md): WordPress Frontend Dashboard plugin \<= 2.2.2 - Sensitive Data Exposure on PII vulnerability (CVSS 7.5, vinoth06. Frontend Dashboard)
- [CVE-2024-32780](https://cve.now/CVE-2024-32780.md): WordPress VikRentCar Car Rental Management System plugin \<= 1.3.2 - Sensitive Data Exposure via Invoices vulnerability (CVSS 5.9, E4J s.r.l. VikRentCar)
- [CVE-2024-32781](https://cve.now/CVE-2024-32781.md): WordPress Email Customizer for WooCommerce plugin \<= 2.6.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, ThemeHigh Email Customizer for WooCommerce)
- [CVE-2024-28963](https://cve.now/CVE-2024-28963.md): Telemetry Dashboard v1.0.0.7 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. (CVSS 6.2, Dell Wyse Proprietary OS)
- [CVE-2024-32782](https://cve.now/CVE-2024-32782.md): WordPress HT Mega plugin \<= 2.4.7 - Sensitive Data Exposure vulnerability (CVSS 4.3, DevItems HT Mega)
- [CVE-2024-32788](https://cve.now/CVE-2024-32788.md): WordPress FG Joomla to Wordpress plugin \<= 4.20.2 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Frédéric GILLES FG Joomla to WordPress)
- [CVE-2024-32796](https://cve.now/CVE-2024-32796.md): WordPress WP Fusion Lite plugin \<= 3.42.10 - Sensitive Data Exposure vulnerability (CVSS 4.3, Jack Arturo WP Fusion Lite)
- [CVE-2024-32816](https://cve.now/CVE-2024-32816.md): WordPress Combo Blocks plugin \<= 2.2.78 - Sensitive Data Exposure via API vulnerability (CVSS 7.5, PickPlugins Post Grid)
- [CVE-2024-32825](https://cve.now/CVE-2024-32825.md): WordPress Simply Static plugin \<= 3.1.3 - Sensitive Data Exposure via Log File vulnerability (CVSS 7.5, Simply Static)
- [CVE-2024-32953](https://cve.now/CVE-2024-32953.md): WordPress Newsletters plugin \<= 4.9.5 - Sensitive Data Exposure vulnerability (CVSS 7.5, Newsletters)
- [CVE-2024-32817](https://cve.now/CVE-2024-32817.md): WordPress Import and export users and customers plugin \<= 1.26.2 - PHP Object Injection vulnerability (CVSS 4.4, Javier Carazo Import and export users and customers)
- [CVE-2024-32835](https://cve.now/CVE-2024-32835.md): WordPress Export and Import Users and Customers plugin \<= 2.5.3 - Deserialization of untrusted data vulnerability (CVSS 5.4, WebToffee Import Export WordPress Users)
- [CVE-2024-32836](https://cve.now/CVE-2024-32836.md): WordPress WP-Lister Lite for eBay plugin \<= 3.5.11 - Arbitrary File Upload vulnerability (CVSS 9.1, WP Lab WP-Lister Lite for eBay)
- [CVE-2024-32718](https://cve.now/CVE-2024-32718.md): WordPress The Pack Elementor addons plugin \<= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Webangon The Pack Elementor addons)
- [CVE-2024-32775](https://cve.now/CVE-2024-32775.md): WordPress Embed Google Photos album plugin \<= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Pavex Embed Google Photos album)
- [CVE-2024-32803](https://cve.now/CVE-2024-32803.md): WordPress SuperFaktura WooCommerce plugin \<= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, 2day.sk, Webikon SuperFaktura WooCommerce)
- [CVE-2024-32812](https://cve.now/CVE-2024-32812.md): WordPress Podlove Podcast Publisher plugin \<= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Podlove Podcast Publisher)
- [CVE-2024-32819](https://cve.now/CVE-2024-32819.md): WordPress Culqi plugin \<= 3.0.14 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Culqi)
- [CVE-2024-32955](https://cve.now/CVE-2024-32955.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Foliovision FV Flowplayer Video Player)
- [CVE-2024-32948](https://cve.now/CVE-2024-32948.md): WordPress ARMember – Membership Plugin plugin \<= 4.0.28 - Broken Access Control vulnerability (CVSS 9.1, Repute Infosystems ARMember)
- [CVE-2024-32951](https://cve.now/CVE-2024-32951.md): WordPress Max Addons Pro for Bricks plugin \<= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerability (CVSS 6.5, BloomPixel Max Addons Pro for Bricks)
- [CVE-2024-31406](https://cve.now/CVE-2024-31406.md): Active debug code vulnerability exists in RoamWiFi R10 prior to 4.8.45. (CVSS 8.8, RoamWiFi Technology Co. RoamWiFi R10)
- [CVE-2024-32051](https://cve.now/CVE-2024-32051.md): Insertion of sensitive information into log file issue exists in RoamWiFi R10 prior to 4.8.45. (CVSS 6.5, RoamWiFi Technology Co. RoamWiFi R10)
- [CVE-2024-3261](https://cve.now/CVE-2024-3261.md): Strong Testimonials \< 3.1.12 - Contributor+ Stored XSS (CVSS 4.8, Strong Testimonials)
- [CVE-2024-2972](https://cve.now/CVE-2024-2972.md): Floating Chat Widget \< 3.1.9 - Editor+ Stored XSS (CVSS 3.8, Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegra…)
- [CVE-2024-2404](https://cve.now/CVE-2024-2404.md): Better Comments \< 1.5.6 - Subscriber+ Stored XSS (CVSS 5.4, Better Comments)
- [CVE-2024-2402](https://cve.now/CVE-2024-2402.md): Better Comments \< 1.5.6 - Admin+ Stored XSS (CVSS 5.4, Better Comments)
- [CVE-2024-1756](https://cve.now/CVE-2024-1756.md): WooCommerce Customers Manager \< 29.8 - Subscriber+ Email Disclosure (CVSS 6.5, WooCommerce Customers Manager)
- [CVE-2024-1743](https://cve.now/CVE-2024-1743.md): WooCommerce Customers Manager \< 29.8 - Reflected XSS (CVSS 5.9, WooCommerce Customers Manager)
- [CVE-2023-7253](https://cve.now/CVE-2023-7253.md): Import WP \< 2.13.1 - Admin+ Server-side Request Forgery (CVSS 6.1, Import WP)
- [CVE-2024-4093](https://cve.now/CVE-2024-4093.md): SourceCodester Simple Subscription Website view\_application.php sql injection (CVSS 6.3, SourceCodester Simple Subscription Website)
- [CVE-2024-28613](https://cve.now/CVE-2024-28613.md): SQL Injection vulnerability in PHP Task Management System v.1.0 allows a remote attacker to escalate privileges and obtain sensitive informa (CVSS 9.8)
- [CVE-2024-33531](https://cve.now/CVE-2024-33531.md): cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the valu (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.