# CVEs published 2024-06-01

21 CVEs were published on June 1, 2024: 2 critical, 5 high. Days are UTC.

- [CVE-2024-35645](https://cve.now/CVE-2024-35645.md): WordPress Random Banner plugin \<= 4.2.12 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, M A Vinoth Kumar Random Banner)
- [CVE-2024-35646](https://cve.now/CVE-2024-35646.md): WordPress Smartarget Message Bar plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Erez Hadas-Sonnenschein Smartarget Message Bar)
- [CVE-2024-35647](https://cve.now/CVE-2024-35647.md): WordPress Global Notification Bar plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Global Notification Bar)
- [CVE-2024-4148](https://cve.now/CVE-2024-4148.md): Redos (Regular Expression Denial of Service) in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-35636](https://cve.now/CVE-2024-35636.md): WordPress Uploadcare File Uploader and Adaptive Delivery plugin \<= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Uploadcare File Uploader and Adaptive Delivery)
- [CVE-2024-3820](https://cve.now/CVE-2024-3820.md): wpDataTables - Tables & Table Charts (Premium) \<= 6.3.1 - Unauthenticated SQL Injection (CVSS 10.0, wpDataTables)
- [CVE-2024-3200](https://cve.now/CVE-2024-3200.md): wpForo Forum \<= 2.3.3 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, tomdever wpForo Forum)
- [CVE-2024-5348](https://cve.now/CVE-2024-5348.md): Elements For Elementor \<= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes (CVSS 8.8, nicdark Elements For Elementor)
- [CVE-2024-3821](https://cve.now/CVE-2024-3821.md): wpDataTables - Tables & Table Charts (Premium) \<= 6.3.2 - Missing Authorization to DataTable Access & Modification (CVSS 7.3, wpDataTables – WordPress Data Table, Dynamic Tables & Table…)
- [CVE-2024-4958](https://cve.now/CVE-2024-4958.md): User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin \<= 3.2.0.1 - Missing Authorization to Privilege Escalation (CVSS 7.1, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2024-2295](https://cve.now/CVE-2024-2295.md): Contact Form Manager \<= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, f1logic Contact Form Manager)
- [CVE-2024-1324](https://cve.now/CVE-2024-1324.md): QQWorld Auto Save Images \<= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval (CVSS 5.3, QQWorld Auto Save Images)
- [CVE-2024-2506](https://cve.now/CVE-2024-2506.md): Popup Builder \<= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2024-4087](https://cve.now/CVE-2024-4087.md): Royal Elementor Addons and Templates \<= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-5501](https://cve.now/CVE-2024-5501.md): Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder \<= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, divisupreme Supreme Modules Lite – Divi Theme, Extra Theme…)
- [CVE-2024-4342](https://cve.now/CVE-2024-4342.md): Royal Elementor Addons and Templates \<= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2023-6382](https://cve.now/CVE-2023-6382.md): Master Slider - Responsive Touch Slider \<= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-3564](https://cve.now/CVE-2024-3564.md): Content Blocks (Custom Post Widget) \<= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, vanderwijk Content Blocks)
- [CVE-2024-3565](https://cve.now/CVE-2024-3565.md): Content Blocks (Custom Post Widget) \<= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via content\_block Shortcode (CVSS 6.4, vanderwijk Content Blocks)
- [CVE-2024-4711](https://cve.now/CVE-2024-4711.md): WordPress Infinite Scroll – Ajax Load More \<= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…)
- [CVE-2024-2933](https://cve.now/CVE-2024-2933.md): Page Builder Gutenberg Blocks – CoBlocks \<= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles (CVSS 6.4, godaddy Page Builder Gutenberg Blocks – CoBlocks)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.