# CVEs published 2024-05-02

243 CVEs were published on May 2, 2024: 9 critical, 53 high. Days are UTC.

- [CVE-2024-30302](https://cve.now/CVE-2024-30302.md): ZDI-CAN-23077: Adobe Acrobat Reader DC AcroForm Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-30301](https://cve.now/CVE-2024-30301.md): ZDI-CAN-23042: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30303](https://cve.now/CVE-2024-30303.md): ZDI-CAN-23044: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30305](https://cve.now/CVE-2024-30305.md): ZDI-CAN-23043: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30306](https://cve.now/CVE-2024-30306.md): ZDI-CAN-23106: Adobe Acrobat Reader DC AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-30304](https://cve.now/CVE-2024-30304.md): ZDI-CAN-23040: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-25047](https://cve.now/CVE-2024-25047.md): IBM Cognos Analytics log injection (CVSS 8.6, IBM Cognos Analytics)
- [CVE-2024-4140](https://cve.now/CVE-2024-4140.md): An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart (CVSS 7.5, rjbs Email-MIME)
- [CVE-2024-34394](https://cve.now/CVE-2024-34394.md): libxmljs2 namespaces type confusion RCE (CVSS 8.1, libxmljs2)
- [CVE-2024-34393](https://cve.now/CVE-2024-34393.md): libxmljs2 attrs type confusion RCE (CVSS 8.1, libxmljs2)
- [CVE-2024-34392](https://cve.now/CVE-2024-34392.md): libxmljs namespaces type confusion RCE (CVSS 8.1, libxmljs)
- [CVE-2024-34391](https://cve.now/CVE-2024-34391.md): libxmljs attrs type confusion RCE (CVSS 8.1, libxmljs)
- [CVE-2024-4216](https://cve.now/CVE-2024-4216.md): XSS vulnerability in /settings/store API response json payload in pgAdmin 4 (CVSS 7.4, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2024-4215](https://cve.now/CVE-2024-4215.md): The Multi Factor Authentication bypass vulnerability in pgAdmin 4 (CVSS 7.4, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2024-3681](https://cve.now/CVE-2024-3681.md): Interactive World Maps \<= 2.4.14 - Reflected Cross-Site Scripting (CVSS 6.1, cmoreira Interactive World Maps)
- [CVE-2024-3473](https://cve.now/CVE-2024-3473.md): Header Footer Code Manager Pro \<= 1.0.16 - Reflected Cross-Site Scripting via message (CVSS 6.1, 99robots Header Footer Code Manager Pro)
- [CVE-2024-4097](https://cve.now/CVE-2024-4097.md): Cost Calculator Builder Pro \<= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload (CVSS 7.2, StylemixThemes Cost Calculator Builder PRO)
- [CVE-2024-0710](https://cve.now/CVE-2024-0710.md): GP Unique ID \<= 1.5.5 - Unauthenticated Form Submission Unique ID Modification (CVSS 5.3, Gravity Wiz GP Unique ID)
- [CVE-2024-2324](https://cve.now/CVE-2024-2324.md): FileOrganizer and FileOrganizer Pro \<= 1.0.6 - Authenticated Stored Cross-Site Scripting (CVSS 4.4, softaculous FileOrganizer – WordPress File Manager)
- [CVE-2024-3849](https://cve.now/CVE-2024-3849.md): Click to Chat – HoliThemes \<= 3.35 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, Click to Chat – HoliThemes)
- [CVE-2024-3601](https://cve.now/CVE-2024-3601.md): Poll Maker – Best WordPress Poll Plugin \<= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration (CVSS 5.3, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2024-2752](https://cve.now/CVE-2024-2752.md): Where Did You Hear About Us Checkout Field for WooCommerce \<= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting (CVSS 5.5, wooassist Where Did You Hear About Us Checkout Field for Wo…)
- [CVE-2024-3553](https://cve.now/CVE-2024-3553.md): Tutor LMS \<= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-2667](https://cve.now/CVE-2024-2667.md): InstaWP Connect – 1-click WP Staging & Migration \<= 0.1.0.22 - Unauthenticated Arbitrary File Upload (CVSS 9.8, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2024-3340](https://cve.now/CVE-2024-3340.md): Colibri Page Builder \<= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode (CVSS 5.4, extendthemes Colibri Page Builder)
- [CVE-2024-3936](https://cve.now/CVE-2024-3936.md): The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid \<= 7.6.1 - Missing Authorization (CVSS 4.3, techlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…)
- [CVE-2024-4086](https://cve.now/CVE-2024-4086.md): CM Tooltip Glossary – Powerful Glossary Plugin \<= 4.2.11 - Cross-Site Request Forgery (CVSS 4.3, creativemindssolutions CM Tooltip Glossary)
- [CVE-2024-3743](https://cve.now/CVE-2024-3743.md): Elementor Addon Elements \<= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2023-7064](https://cve.now/CVE-2023-7064.md): Shortcodes and extra features for Phlox theme \<= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin\_template\_control\_importer (CVSS 7.5, averta Shortcodes and extra features for Phlox theme)
- [CVE-2023-7030](https://cve.now/CVE-2023-7030.md): Collapse-O-Matic \<= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, baden03 Collapse-O-Matic)
- [CVE-2024-2751](https://cve.now/CVE-2024-2751.md): Exclusive Addons for Elementor \<= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-2273](https://cve.now/CVE-2024-2273.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-2960](https://cve.now/CVE-2024-2960.md): SVS Pricing Tables \<= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion (CVSS 4.3, svs-websoft SVS Pricing Tables)
- [CVE-2024-3897](https://cve.now/CVE-2024-3897.md): Popup Box – Best WordPress Popup Plugin \<= 4.3.6 - Missing Authorization to Information Exposure (CVSS 5.3, ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…)
- [CVE-2023-6731](https://cve.now/CVE-2023-6731.md): WP Show Posts \<= 1.1.5 - Improper Authorization to Information Exposure (CVSS 4.3, edge22 WP Show Posts)
- [CVE-2024-3747](https://cve.now/CVE-2024-3747.md): Blocksy \<= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block (CVSS 6.4, creativethemeshq Blocksy)
- [CVE-2024-4033](https://cve.now/CVE-2024-4033.md): All-in-One Video Gallery \<= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image (CVSS 8.8, plugins360 All-in-One Video Gallery)
- [CVE-2024-2876](https://cve.now/CVE-2024-2876.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.14 - Unauthenticated SQL Injection (CVSS 9.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-1716](https://cve.now/CVE-2024-1716.md): Admin Bar Remover \<= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, litonice13 Admin Bar Editor – Toolbar Customization with Us…)
- [CVE-2024-4324](https://cve.now/CVE-2024-4324.md): WP Video Lightbox \<= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (CVSS 6.4, wptipsntricks WP Video Lightbox)
- [CVE-2024-3607](https://cve.now/CVE-2024-3607.md): PropertyHive \<= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 4.3, propertyhive Property Hive)
- [CVE-2024-1415](https://cve.now/CVE-2024-1415.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.8.9 - Cross-Site Request Forgery (CVSS 4.3, themehunk Lead Form Builder & Contact Form)
- [CVE-2024-1759](https://cve.now/CVE-2024-1759.md): WP ULike \<= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, alimir WP ULike – Like & Dislike Buttons for Engagement and…)
- [CVE-2024-4034](https://cve.now/CVE-2024-4034.md): Virtue \<= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author (CVSS 6.4, stellarwp Virtue)
- [CVE-2024-2328](https://cve.now/CVE-2024-2328.md): Real Media Library \<= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, devowl Real Media Library: Media Library Folder & File Mana…)
- [CVE-2024-1797](https://cve.now/CVE-2024-1797.md): WP ULike – Most Advanced WordPress Marketing Toolkit \<= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes (CVSS 8.8, alimir WP ULike – Like & Dislike Buttons for Engagement and…)
- [CVE-2024-1416](https://cve.now/CVE-2024-1416.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.8.9 - Missing Authorization (CVSS 4.3, themehunk Lead Form Builder & Contact Form)
- [CVE-2024-2417](https://cve.now/CVE-2024-2417.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2024-2082](https://cve.now/CVE-2024-2082.md): EleForms – All In One Form Integration including DB for Elementor \<= 2.9.9.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, cscode EleForms – All In One Form Integration including DB…)
- [CVE-2024-3725](https://cve.now/CVE-2024-3725.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-3233](https://cve.now/CVE-2024-3233.md): Ivory Search – WordPress Search Plugin \<= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation (CVSS 4.3, vinod-dalvi Ivory Search – WordPress Search Plugin)
- [CVE-2024-1840](https://cve.now/CVE-2024-1840.md): WPBakery Visual Composer \<= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author (CVSS 6.4, WPBakery Page Builder)
- [CVE-2023-6961](https://cve.now/CVE-2023-6961.md): WP Meta SEO \<= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer header (CVSS 7.2, joomunited WP Meta SEO)
- [CVE-2024-3500](https://cve.now/CVE-2024-3500.md): ElementsKit Pro \<= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets (CVSS 8.8, wpmet ElementsKit Pro)
- [CVE-2024-2349](https://cve.now/CVE-2024-2349.md): Fancy Elementor Flipbox \<= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget (CVSS 6.4, hosseinhashemi Fancy Elementor Flipbox)
- [CVE-2024-3307](https://cve.now/CVE-2024-3307.md): HT Mega – Absolute Addons For Elementor \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-4036](https://cve.now/CVE-2024-4036.md): Sydney Toolbox \<= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, smub Sydney Toolbox)
- [CVE-2024-3588](https://cve.now/CVE-2024-3588.md): Getwid – Gutenberg Blocks \<= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' (CVSS 6.4, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-2401](https://cve.now/CVE-2024-2401.md): Admin Page Spider \<= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, jatacid Admin Page Spider)
- [CVE-2024-1679](https://cve.now/CVE-2024-1679.md): Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce \<= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates (CVSS 6.4, ukrsolution Print Labels with Barcodes. Create price tags,…)
- [CVE-2024-4000](https://cve.now/CVE-2024-4000.md): WordPress Header Builder Plugin – Pearl \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stylemix Pearl – Header Builder)
- [CVE-2024-0613](https://cve.now/CVE-2024-0613.md): Delete Custom Fields \<= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion (CVSS 6.1, gluten Delete Custom Fields)
- [CVE-2024-3606](https://cve.now/CVE-2024-3606.md): ProfileGrid – User Profiles, Memberships, Groups and Communities \<= 5.8.3 - Missing Authorization (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-3550](https://cve.now/CVE-2024-3550.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-0629](https://cve.now/CVE-2024-0629.md): 2Checkout Payment Gateway for WooCommerce \<= 6.2 - Missing Authorization via sniff\_ins (CVSS 5.3, nmedia 2Checkout Payment Gateway for WooCommerce)
- [CVE-2024-4085](https://cve.now/CVE-2024-4085.md): Tabellen von faustball.com \<= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, docolli Tabellen von faustball.com)
- [CVE-2024-3337](https://cve.now/CVE-2024-3337.md): Colibri Page Builder \<= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri\_breadcrumb\_element' Shortcode (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2024-3197](https://cve.now/CVE-2024-3197.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-3891](https://cve.now/CVE-2024-3891.md): Happy Addons for Elementor \<= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-3715](https://cve.now/CVE-2024-3715.md): Database for Contact Form 7, WPforms, Elementor forms \<= 1.3.8 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, crmperks Database for Contact Form 7, WPforms, Elementor fo…)
- [CVE-2024-3199](https://cve.now/CVE-2024-3199.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-3215](https://cve.now/CVE-2024-3215.md): Paid Memberships Pro \<= 3.0.1 - Cross-Site Request Forgery (CVSS 5.3, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2024-4265](https://cve.now/CVE-2024-4265.md): Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-3517](https://cve.now/CVE-2024-3517.md): Shortcodes and extra features for Phlox theme \<= 2.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widget (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-3729](https://cve.now/CVE-2024-3729.md): Frontend Admin by DynamiApps \<= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2024-0615](https://cve.now/CVE-2024-0615.md): Content Control \<= 2.1.0 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, danieliser Content Control – The Ultimate Content Restricti…)
- [CVE-2024-2797](https://cve.now/CVE-2024-2797.md): MailerLite – Signup forms (official) \<= 1.7.6 - Missing Authorization (CVSS 5.3, MailerLite – Signup forms)
- [CVE-2024-3287](https://cve.now/CVE-2024-3287.md): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \<= 3.10.2 - Missing Authorization (CVSS 5.3, wpmudev SmartCrawl SEO checker, analyzer & optimizer)
- [CVE-2024-3870](https://cve.now/CVE-2024-3870.md): Contact Form 7 Database Addon – CFDB7 \<= 1.2.6.8 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, arshidkv12 Database Addon for Contact Form 7 – CFDB7)
- [CVE-2024-1173](https://cve.now/CVE-2024-1173.md): WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting \<= 1.13.1 - Authenticated (AccountingManager+) SQL Injection (CVSS 7.2, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-3650](https://cve.now/CVE-2024-3650.md): The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all ver (CVSS 6.4, xpeedstudio ElementsKit Elementor addons and Templates Libr…)
- [CVE-2024-0848](https://cve.now/CVE-2024-0848.md): AA Cash Calculator \<= 1.0 - Reflected Cross-Site Scripting via invoice (CVSS 6.1, aaextention AA Cash Calculator)
- [CVE-2024-2542](https://cve.now/CVE-2024-2542.md): Jotform Online Forms \<= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Online Forms — Customizable Payment, Contact, Quiz, Survey…)
- [CVE-2024-0908](https://cve.now/CVE-2024-0908.md): Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page \<= 1.13.4 - Missing Authorization to Information Disclosure (CVSS 5.3, bplugins Advanced Post Block – Showcase Posts with Grid, Li…)
- [CVE-2024-2084](https://cve.now/CVE-2024-2084.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-3312](https://cve.now/CVE-2024-3312.md): Easy Custom Auto Excerpt \<= 2.4.12 - Sensitive Information Exposure (CVSS 5.3, todiadiatmo Easy Custom Auto Excerpt)
- [CVE-2024-1533](https://cve.now/CVE-2024-1533.md): Shortcodes and extra features for Phlox theme \<= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-2109](https://cve.now/CVE-2024-2109.md): Booster Extension \<= 1.2.0 - Basic Information Exposure via booster\_extension\_authorbox\_shortcode\_display (CVSS 5.3, themeinwp Booster Extension)
- [CVE-2024-2765](https://cve.now/CVE-2024-2765.md): Ultimate Member \<= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-3295](https://cve.now/CVE-2024-3295.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.1.5 - Missing Authorization to Unauthenticated Media Deletion (CVSS 6.5, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2023-7067](https://cve.now/CVE-2023-7067.md): ShopLentor \<= 2.8.1 - Improper Authorization via woolentor\_template\_store (CVSS 4.3, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-4092](https://cve.now/CVE-2024-4092.md): Slider Revolution \<= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter (CVSS 6.4, Revolution Slider Slider Revolution)
- [CVE-2024-2967](https://cve.now/CVE-2024-2967.md): Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor \<= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, aharonyan Guest posting / Frontend Posting / Front Editor –…)
- [CVE-2024-2346](https://cve.now/CVE-2024-2346.md): FileBird – WordPress Media Library Folders & File Manager \<= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference (CVSS 5.4, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2024-3724](https://cve.now/CVE-2024-3724.md): Happy Addons for Elementor \<= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-4133](https://cve.now/CVE-2024-4133.md): ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup \<= 4.0.30 - Open Redirect (CVSS 6.1, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2024-1386](https://cve.now/CVE-2024-1386.md): The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in (CVSS 6.4, MailerLite – Signup forms)
- [CVE-2024-3677](https://cve.now/CVE-2024-3677.md): Ultimate 410 Gone Status Code \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tinyweb Ultimate 410 Gone Status Code)
- [CVE-2024-1809](https://cve.now/CVE-2024-1809.md): Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) \<= 5.2.3 - Missing Authorization (CVSS 5.4, hiddenpearls Analytify – Google Analytics Dashboard For Wor…)
- [CVE-2024-1805](https://cve.now/CVE-2024-1805.md): WPBakery Visual Composer \<= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute (CVSS 6.4, WPBakery Page Builder)
- [CVE-2024-1567](https://cve.now/CVE-2024-1567.md): Royal Elementor Addons and Templates \<= 1.3.94 - Unauthenticated Limited File Upload (CVSS 8.2, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-2959](https://cve.now/CVE-2024-2959.md): SVS Pricing Tables \<= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation (CVSS 4.3, svs-websoft SVS Pricing Tables)
- [CVE-2024-3489](https://cve.now/CVE-2024-3489.md): Exclusive Addons for Elementor \<= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-1993](https://cve.now/CVE-2024-1993.md): Icon Widget \<= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, seothemes Icon Widget)
- [CVE-2024-1677](https://cve.now/CVE-2024-1677.md): Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce \<= 3.4.6 - Improper Authorization (CVSS 6.3, ukrsolution Print Labels with Barcodes. Create price tags,…)
- [CVE-2024-2043](https://cve.now/CVE-2024-2043.md): EleForms – All In One Form Integration including DB for Elementor \<= 2.9.9.7 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, cscode EleForms – All In One Form Integration including DB…)
- [CVE-2024-3649](https://cve.now/CVE-2024-3649.md): Contact Form by WPForms – Drag & Drop Form Builder for WordPress \<= 1.8.7.2 - Unauthenticated Price Manipulation (CVSS 5.3, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2024-1842](https://cve.now/CVE-2024-1842.md): WPBakery Visual Composer \<= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attribute (CVSS 6.4, WPBakery Page Builder)
- [CVE-2024-2958](https://cve.now/CVE-2024-2958.md): SVS Pricing Tables \<= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, svs-websoft SVS Pricing Tables)
- [CVE-2024-3942](https://cve.now/CVE-2024-3942.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.3.8 - Missing Authorization (CVSS 6.3, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-1688](https://cve.now/CVE-2024-1688.md): Woo Total Sales \<= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval (CVSS 5.3, shivashankerbhatta Woo Total Sales)
- [CVE-2024-3670](https://cve.now/CVE-2024-3670.md): Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) \<= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, harmr Leaflet Maps Marker)
- [CVE-2024-3499](https://cve.now/CVE-2024-3499.md): ElementsKit Elementor addons \<= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module (CVSS 8.8, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-3275](https://cve.now/CVE-2024-3275.md): eRoom – Zoom Meetings & Webinar \<= 1.4.18 - Missing Authorization to Information Exposure (CVSS 4.3, digitalmeactivecampaign eRoom – Webinar & Meeting Plugin fo…)
- [CVE-2024-1678](https://cve.now/CVE-2024-1678.md): Subway – Private Site Option \<= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API (CVSS 5.3, dunhakdis Subway – Private Site Option)
- [CVE-2024-3991](https://cve.now/CVE-2024-3991.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via \_id (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-1396](https://cve.now/CVE-2024-1396.md): Shortcodes and extra features for Phlox theme \<= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title\_tag' (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2023-6214](https://cve.now/CVE-2023-6214.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Sensitive Information Exposure via purchased\_products (CVSS 7.5, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-2790](https://cve.now/CVE-2024-2790.md): HT Mega – Absolute Addons For Elementor \<= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-3674](https://cve.now/CVE-2024-3674.md): Inline Google Spreadsheet Viewer \<= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, meitar Inline Google Spreadsheet Viewer)
- [CVE-2024-4203](https://cve.now/CVE-2024-4203.md): Premium Addons for Elementor \<= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-2867](https://cve.now/CVE-2024-2867.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-1572](https://cve.now/CVE-2024-1572.md): WP ULike \<= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, alimir WP ULike – Like & Dislike Buttons for Engagement and…)
- [CVE-2024-3734](https://cve.now/CVE-2024-3734.md): FOX – Currency Switcher Professional for WooCommerce \<= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2024-3599](https://cve.now/CVE-2024-3599.md): WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) \<= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2024-3647](https://cve.now/CVE-2024-3647.md): Premium Addons for Elementor \<= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow\_style' (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-3161](https://cve.now/CVE-2024-3161.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-3071](https://cve.now/CVE-2024-3071.md): ACF On-The-Go \<= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update (CVSS 4.3, amaa ACF On-The-Go)
- [CVE-2024-3819](https://cve.now/CVE-2024-3819.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-3895](https://cve.now/CVE-2024-3895.md): WP Datepicker \<= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, fahadmahmood WP Datepicker)
- [CVE-2024-3885](https://cve.now/CVE-2024-3885.md): Premium Addons for Elementor \<= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-2661](https://cve.now/CVE-2024-2661.md): Barcode Scanner with Inventory & Order Manager \<= 1.5.4 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, ukrsolution Barcode Scanner (+Mobile App) – Inventory manag…)
- [CVE-2024-3338](https://cve.now/CVE-2024-3338.md): Colibri Page Builder \<= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 4.4, extendthemes Colibri Page Builder)
- [CVE-2024-1897](https://cve.now/CVE-2024-1897.md): Grid Gallery – Photo Image Grid Gallery \<= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode (CVSS 7.5, awordpresslife Grid Gallery for Images)
- [CVE-2024-3341](https://cve.now/CVE-2024-3341.md): Shortcodes and extra features for Phlox theme \<= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux\_gmaps' Shortcode (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-1841](https://cve.now/CVE-2024-1841.md): WPBakery Visual Composer \<= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute (CVSS 6.4, WPBakery Page Builder)
- [CVE-2024-3308](https://cve.now/CVE-2024-3308.md): HT Mega – Absolute Addons For Elementor \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-3546](https://cve.now/CVE-2024-3546.md): WordPress Backup & Migration \<= 1.4.8 - Missing Authorization to Directory Traversal (CVSS 4.3, WebToffee WP Backup and Migration)
- [CVE-2024-3675](https://cve.now/CVE-2024-3675.md): Royal Elementor Addons and Templates \<= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-2750](https://cve.now/CVE-2024-2750.md): Exclusive Addons for Elementor \<= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-3021](https://cve.now/CVE-2024-3021.md): Mhr Post Ticker \<= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mdhadid Mhr Post Ticker)
- [CVE-2024-3045](https://cve.now/CVE-2024-3045.md): PDF Invoices & Packing Slips for WooCommerce \<= 3.8.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2024-1584](https://cve.now/CVE-2024-1584.md): Analytify \<= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification (CVSS 5.3, hiddenpearls Analytify – Google Analytics Dashboard For Wor…)
- [CVE-2024-2503](https://cve.now/CVE-2024-2503.md): Exclusive Addons for Elementor \<= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-3554](https://cve.now/CVE-2024-3554.md): All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic \<= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2024-3728](https://cve.now/CVE-2024-3728.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-4156](https://cve.now/CVE-2024-4156.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-3985](https://cve.now/CVE-2024-3985.md): Exclusive Addons for Elementor \<= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-3206](https://cve.now/CVE-2024-3206.md): Different Menu in Different Pages – Control Menu Visibility (All in One) \<= 2.3.2 - Missing Authorization to Menu Duplication (CVSS 4.3, recorp Different Menu in Different Pages – Conditional Menu)
- [CVE-2024-4003](https://cve.now/CVE-2024-4003.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-3047](https://cve.now/CVE-2024-3047.md): PDF Invoices & Packing Slips for WooCommerce \<= 3.8.0 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, wpovernight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2024-0847](https://cve.now/CVE-2024-0847.md): 5280 Bootstrap Modal Contact Form \<= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages (CVSS 4.3, 5280studios 5280 Bootstrap Modal Contact Form)
- [CVE-2024-4334](https://cve.now/CVE-2024-4334.md): Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder \<= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting (CVSS 6.4, divisupreme Supreme Modules Lite – Divi Theme, Extra Theme…)
- [CVE-2024-3957](https://cve.now/CVE-2024-3957.md): Booster for WooCommerce \<= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2024-2840](https://cve.now/CVE-2024-2840.md): Enhanced Media Library \<= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 5.4, webbistro Enhanced Media Library)
- [CVE-2024-3717](https://cve.now/CVE-2024-3717.md): Drag and Drop Multiple File Upload – Contact Form 7 \<= 1.3.7.7 - Sensitive Information Exposure (CVSS 5.3, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2024-4083](https://cve.now/CVE-2024-4083.md): Easy Restaurant Table Booking \<= 1.0.0 - Cross-Site Request Forgery (CVSS 4.3, way2neelam Easy Restaurant Table Booking)
- [CVE-2024-1896](https://cve.now/CVE-2024-1896.md): Photo Gallery \<= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode (CVSS 7.5, awordpresslife Photo Gallery for Images)
- [CVE-2024-2345](https://cve.now/CVE-2024-2345.md): FileBird – WordPress Media Library Folders & File Manager \<= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2024-3107](https://cve.now/CVE-2024-3107.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.6 - Authenticated (Contributor+) Path Traversal (CVSS 4.3, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2024-1959](https://cve.now/CVE-2024-1959.md): Social Sharing Plugin – Social Warfare \<= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, warfareplugins Social Sharing Plugin – Social Warfare)
- [CVE-2024-2085](https://cve.now/CVE-2024-2085.md): HT Mega – Absolute Addons For Elementor \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-1348](https://cve.now/CVE-2024-1348.md): Shortcodes and extra features for Phlox theme \<= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-3074](https://cve.now/CVE-2024-3074.md): Elementor ImageBox \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, flickdevs Elementor ImageBox)
- [CVE-2024-3520](https://cve.now/CVE-2024-3520.md): Country State City Dropdown CF7 \<= 2.7.1 - Missing Authorization (CVSS 4.3, trustyplugins Country State City Dropdown CF7)
- [CVE-2024-2831](https://cve.now/CVE-2024-2831.md): Calendar \<= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, kieranoshea Calendar)
- [CVE-2024-3585](https://cve.now/CVE-2024-3585.md): Send PDF for Contact Form 7 \<= 1.0.2.3 - Missing Authorization (CVSS 5.3, florent73 Send PDF for Contact Form)
- [CVE-2024-3581](https://cve.now/CVE-2024-3581.md): MaxGalleria \<= 6.4.2 - Missing Authorization (CVSS 4.3, maxfoundry MaxGalleria)
- [CVE-2024-3023](https://cve.now/CVE-2024-3023.md): AnnounceKit \<= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, restpack AnnounceKit)
- [CVE-2023-6962](https://cve.now/CVE-2023-6962.md): WP Meta SEO \<= 4.5.12 - Information Exposure via Meta Description (CVSS 5.3, joomunited WP Meta SEO)
- [CVE-2024-1945](https://cve.now/CVE-2024-1945.md): ARForms Form Builder \<= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion (CVSS 7.1, reputeinfosystems Contact Form, Survey, Quiz & Popup Form B…)
- [CVE-2024-33948](https://cve.now/CVE-2024-33948.md): WordPress TweetScroll Widget plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.5, Pixel Industry TweetScroll Widget)
- [CVE-2024-33949](https://cve.now/CVE-2024-33949.md): WordPress Min and Max Purchase for WooCommerce plugin \<= 2.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vark Min and Max Purchase for WooCommerce)
- [CVE-2024-4433](https://cve.now/CVE-2024-4433.md): WordPress Simple Image Popup plugin \<= 2.4.0 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Mr Digital Simple Image Popup)
- [CVE-2024-4406](https://cve.now/CVE-2024-4406.md): Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability (CVSS 8.8, Xiaomi Pro)
- [CVE-2024-4405](https://cve.now/CVE-2024-4405.md): Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability (CVSS 8.8, Xiaomi Pro)
- [CVE-2024-4029](https://cve.now/CVE-2024-4029.md): Wildfly: no timeout for eap management interface may lead to denial of service (dos) (CVSS 4.1, wildfly · Red Hat JBoss Enterprise Application Platform +7)
- [CVE-2023-47727](https://cve.now/CVE-2023-47727.md): IBM QRadar Suite Software file manipulation (CVSS 4.3, IBM Cloud Pak for Security · IBM QRadar Suite Software)
- [CVE-2024-3544](https://cve.now/CVE-2024-3544.md): LoadMaster Hardcoded SSH Key (CVSS 7.5, Progress Software LoadMaster)
- [CVE-2024-3543](https://cve.now/CVE-2024-3543.md): LoadMaster Reversible Password Encryption Algorithm (CVSS 6.4, Progress Software LoadMaster)
- [CVE-2024-34061](https://cve.now/CVE-2024-34061.md): Reflected cross site scripting in changedetection.io (CVSS 4.3, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-30251](https://cve.now/CVE-2024-30251.md): Denial of service when trying to parse malformed POST requests in aiohttp (CVSS 7.5, aio-libs aiohttp · aiohttp)
- [CVE-2024-34148](https://cve.now/CVE-2024-34148.md): Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is (CVSS 6.8, Jenkins Project Jenkins Subversion Partial Release Manager…)
- [CVE-2024-34147](https://cve.now/CVE-2024-34147.md): Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins cont (CVSS 4.3, Jenkins Project Jenkins Telegram Bot Plugin · org.jenkins-c…)
- [CVE-2024-34146](https://cve.now/CVE-2024-34146.md): Jenkins Git server Plugin 114.v068a\_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, a (CVSS 6.5, Jenkins Project Jenkins Git server Plugin · org.jenkins-ci.…)
- [CVE-2024-34145](https://cve.now/CVE-2024-34145.md): A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script Security (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2024-34144](https://cve.now/CVE-2024-34144.md): A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a\_e and earlier allows (CVSS 9.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2024-4128](https://cve.now/CVE-2024-4128.md): CSRF in firebase-tools emulator suite (CVSS 2.6, firebase-tools · github.com/firebase/firebase-tools)
- [CVE-2023-37244](https://cve.now/CVE-2023-37244.md): Privilege escalation in N-Able's AutomationManagerAgent (CVSS 5.3, N-Able AutomationManagerAgent)
- [CVE-2024-23462](https://cve.now/CVE-2024-23462.md): ZCC Mac validinstaller file integrity check missing (CVSS 3.3, Zscaler Client Connector)
- [CVE-2024-23461](https://cve.now/CVE-2024-23461.md): ZCC macOS Upgrade ZIP Bomb DoS (CVSS 4.2, Zscaler Client Connector)
- [CVE-2024-23459](https://cve.now/CVE-2024-23459.md): Multiple Arbitrary Creates/Overwrites by link following (CVSS 7.1, Zscaler Client Connector)
- [CVE-2023-41971](https://cve.now/CVE-2023-41971.md): Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control (CVSS 5.3, Zscaler Client Connector)
- [CVE-2023-41970](https://cve.now/CVE-2023-41970.md): Repair App local code execution with arbitrary privileges (CVSS 6.0, Zscaler Client Connector)
- [CVE-2023-28798](https://cve.now/CVE-2023-28798.md): Out-of-bounds write to heap in pacparser (CVSS 6.5, Zscaler Client Connector)
- [CVE-2024-33950](https://cve.now/CVE-2024-33950.md): WordPress Archives Calendar Widget plugin \<= 1.0.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Aleksei Polechin (alek´) Archives Calendar Widget)
- [CVE-2024-33951](https://cve.now/CVE-2024-33951.md): WordPress Perfect Pullquotes plugin \<= 1.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Adam DeHaven Perfect Pullquotes)
- [CVE-2024-33942](https://cve.now/CVE-2024-33942.md): WordPress Google Typography plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 4.3, Eric Alli Google Typography)
- [CVE-2024-33944](https://cve.now/CVE-2024-33944.md): WordPress WooCommerce AWeber Newsletter Subscription plugin \<= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability (CVSS 6.5, Kestrel WooCommerce AWeber Newsletter Subscription)
- [CVE-2024-33956](https://cve.now/CVE-2024-33956.md): WordPress Custom WooCommerce Checkout Fields Editor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 4.3, ThemeLocation Custom WooCommerce Checkout Fields Editor)
- [CVE-2024-33952](https://cve.now/CVE-2024-33952.md): WordPress Unique theme \<= 0.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Justin Tadlock Unique)
- [CVE-2024-33953](https://cve.now/CVE-2024-33953.md): WordPress Adventure Journal theme \<= 1.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Matt van Andel Adventure Journal)
- [CVE-2024-33954](https://cve.now/CVE-2024-33954.md): WordPress Pliska theme \<= 0.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atanas Yonkov Pliska)
- [CVE-2024-33955](https://cve.now/CVE-2024-33955.md): WordPress Freesia Empire theme \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Freesia Empire)
- [CVE-2024-33938](https://cve.now/CVE-2024-33938.md): WordPress Sliding Widgets plugin \<= 1.5.0 - Broken Access Control to XSS vulnerability (CVSS 6.5, codename065 Sliding Widgets)
- [CVE-2024-33911](https://cve.now/CVE-2024-33911.md): WordPress The School Management Pro plugin \<= 10.3.4 - SQL Injection vulnerability (CVSS 7.6, Weblizar School Management Pro)
- [CVE-2024-33922](https://cve.now/CVE-2024-33922.md): WordPress WP Media Cleaner plugin \<= 6.7.2 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Jordy Meow WP Media Cleaner)
- [CVE-2024-3005](https://cve.now/CVE-2024-3005.md): LA-Studio Element Kit for Elementor \<= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget (CVSS 6.4, choijun LA-Studio Element Kit for Elementor)
- [CVE-2024-33930](https://cve.now/CVE-2024-33930.md): WordPress Share This Image plugin \<= 1.97 - Open Redirection vulnerability (CVSS 4.7, ILLID Share This Image)
- [CVE-2024-33913](https://cve.now/CVE-2024-33913.md): WordPress Xserver Migrator plugin \<= 1.6.1 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, Xserver Migrator)
- [CVE-2024-3955](https://cve.now/CVE-2024-3955.md): Arbitrary code execution in CraftBeerPi 4 (CVSS 9.8, PiBrewing CraftBeerPi · CraftBeerPi - Brewing Controller… +1)
- [CVE-2024-32638](https://cve.now/CVE-2024-32638.md): Apache APISIX: Forward-Auth Request Smuggling (CVSS 6.3, Apache Software Foundation Apache APISIX)
- [CVE-2024-3883](https://cve.now/CVE-2024-3883.md): 3D FlipBook \<= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL (CVSS 6.4, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…)
- [CVE-2024-32114](https://cve.now/CVE-2024-32114.md): Apache ActiveMQ: Jolokia and REST API were not secured with default configuration (CVSS 8.5, Apache Software Foundation Apache ActiveMQ · org.apache.act…)
- [CVE-2024-3280](https://cve.now/CVE-2024-3280.md): Follow Us Badges \<= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite\_follow\_us\_badges Shortcode (CVSS 6.4, draftpress Follow Us Badges)
- [CVE-2024-32882](https://cve.now/CVE-2024-32882.md): Permission check bypass when editing a model with per-field restrictions in wagtail (CVSS 2.7, wagtail)
- [CVE-2024-3490](https://cve.now/CVE-2024-3490.md): WP Recipe Maker \<= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2024-32962](https://cve.now/CVE-2024-32962.md): XML signature verification bypass due improper verification of signature / signature spoofing (CVSS 10.0, node-saml xml-crypto · xml-crypto)
- [CVE-2024-32971](https://cve.now/CVE-2024-32971.md): Defect in query plan cache may cause incorrect operations to be executed in Apollo Router (CVSS 9.1, apollographql router · apollo-router)
- [CVE-2024-3481](https://cve.now/CVE-2024-3481.md): Counter Box \< 1.2.4 - Counter Deletion via CSRF (CVSS 5.2, Counter Box)
- [CVE-2024-3478](https://cve.now/CVE-2024-3478.md): Herd Effects \< 5.2.7 - Effect Deletion via CSRF (CVSS 6.1, Herd Effects)
- [CVE-2024-3477](https://cve.now/CVE-2024-3477.md): Popup Box \< 2.2.7 - Popup Deletion via CSRF (CVSS 4.3, Popup Box)
- [CVE-2024-3476](https://cve.now/CVE-2024-3476.md): Side Menu Lite \< 4.2.1 - Menu Deletion via CSRF (CVSS 8.8, Side Menu Lite)
- [CVE-2024-3475](https://cve.now/CVE-2024-3475.md): Sticky Buttons \< 3.2.4 - Button Deletion via CSRF (CVSS 7.5, Sticky Buttons)
- [CVE-2024-3474](https://cve.now/CVE-2024-3474.md): Wow Skype Buttons \< 4.0.4 - Button Deletion via CSRF (CVSS 8.8, Wow Skype Buttons)
- [CVE-2024-3472](https://cve.now/CVE-2024-3472.md): Modal Window \< 5.3.10 - Modal Deletion via CSRF (CVSS 5.9, Modal Window)
- [CVE-2024-3471](https://cve.now/CVE-2024-3471.md): Button Generator \< 3.0 - Button Deletion via CSRF (CVSS 3.4, Button Generator)
- [CVE-2024-2405](https://cve.now/CVE-2024-2405.md): Float menu \< 6.0.1 - Menu Deletion via CSRF (CVSS 4.5, Float menu)
- [CVE-2023-50685](https://cve.now/CVE-2023-50685.md): An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client\_port pa (CVSS 7.5)
- [CVE-2024-25290](https://cve.now/CVE-2024-25290.md): An issue in Casa Systems NL1901ACV R6B032 allows a remote attacker to execute arbitrary code via the userName parameter of the add function. (CVSS 8.0)
- [CVE-2024-29309](https://cve.now/CVE-2024-29309.md): An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service. (CVSS 7.7)
- [CVE-2024-31963](https://cve.now/CVE-2024-31963.md): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (CVSS 6.4)
- [CVE-2024-31964](https://cve.now/CVE-2024-31964.md): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (CVSS 7.5)
- [CVE-2024-31965](https://cve.now/CVE-2024-31965.md): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (CVSS 4.2)
- [CVE-2024-31966](https://cve.now/CVE-2024-31966.md): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (CVSS 6.2)
- [CVE-2024-31967](https://cve.now/CVE-2024-31967.md): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (CVSS 9.1)
- [CVE-2024-32359](https://cve.now/CVE-2024-32359.md): An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtai (CVSS 6.9, github.com/carina-io/carina)
- [CVE-2024-33302](https://cve.now/CVE-2024-33302.md): SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add Users. (CVSS 5.3)
- [CVE-2024-33303](https://cve.now/CVE-2024-33303.md): SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" under Add Users. (CVSS 8.2)
- [CVE-2024-33305](https://cve.now/CVE-2024-33305.md): SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User. (CVSS 6.1)
- [CVE-2024-33394](https://cve.now/CVE-2024-33394.md): An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token com (CVSS 5.9, kubevirt.io/kubevirt)
- [CVE-2024-33396](https://cve.now/CVE-2024-33396.md): An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token co (CVSS 8.4, github.com/karmada-io/karmada)
- [CVE-2024-33530](https://cve.now/CVE-2024-33530.md): In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeti (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.