# CVEs published 2024-06-08

78 CVEs were published on June 8, 2024: 2 critical, 20 high. Days are UTC.

- [CVE-2024-5771](https://cve.now/CVE-2024-5771.md): LabVantage LIMS POST Request sql injection (CVSS 5.3, LabVantage LIMS)
- [CVE-2024-4146](https://cve.now/CVE-2024-4146.md): Incorrect Authorization in lunary-ai/lunary (CVSS 9.8, lunary-ai/lunary)
- [CVE-2024-4680](https://cve.now/CVE-2024-4680.md): Insufficient Session Expiration in zenml-io/zenml (CVSS 3.9, zenml-io/zenml · zenml)
- [CVE-2024-22151](https://cve.now/CVE-2024-22151.md): WordPress Import and export users and customers plugin \<= 1.24.6 - Broken Access Control vulnerability (CVSS 5.3, Codection Import and export users and customers)
- [CVE-2024-21748](https://cve.now/CVE-2024-21748.md): WordPress Icegram Engage plugin \<= 3.1.21 - Broken Access Control vulnerability (CVSS 4.3, Icegram)
- [CVE-2024-35657](https://cve.now/CVE-2024-35657.md): WordPress WP-Recall plugin \<= 16.26.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Plechev Andrey WP-Recall)
- [CVE-2024-35659](https://cve.now/CVE-2024-35659.md): WordPress KiviCare plugin \<= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Iqonic Design KiviCare)
- [CVE-2024-35675](https://cve.now/CVE-2024-35675.md): WordPress Advanced Woo Labels plugin \<= 1.93 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ILLID Advanced Woo Labels)
- [CVE-2024-35676](https://cve.now/CVE-2024-35676.md): WordPress Recurring PayPal Donations plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpecommerce Recurring PayPal Donations)
- [CVE-2024-35678](https://cve.now/CVE-2024-35678.md): WordPress Contact Form to DB by BestWebSoft plugin \<= 1.7.2 - SQL Injection vulnerability (CVSS 8.5, Contact Form to DB by BestWebSoft)
- [CVE-2023-45707](https://cve.now/CVE-2023-45707.md): HCL Connections Docs is vulnerable to Cross-Site Scripting (XSS) (CVSS 4.4, HCL Software Connections Docs)
- [CVE-2024-35679](https://cve.now/CVE-2024-35679.md): WordPress GiveWP plugin \<= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, StellarWP GiveWP)
- [CVE-2024-35681](https://cve.now/CVE-2024-35681.md): WordPress wpDiscuz plugin \<= 7.6.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, gVectors Team wpDiscuz)
- [CVE-2024-35682](https://cve.now/CVE-2024-35682.md): WordPress Otter Blocks PRO plugin \<= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability (CVSS 4.3, Themeisle Otter Blocks PRO)
- [CVE-2024-35684](https://cve.now/CVE-2024-35684.md): WordPress ElasticPress plugin \<= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, 10up ElasticPress)
- [CVE-2024-34765](https://cve.now/CVE-2024-34765.md): WordPress Sensei Pro (WC Paid Courses) plugin \<= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sensei Pro)
- [CVE-2024-35687](https://cve.now/CVE-2024-35687.md): WordPress Link Library plugin \<= 7.6.3 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 7.1, Yannick Lefebvre Link Library)
- [CVE-2024-35688](https://cve.now/CVE-2024-35688.md): WordPress Master Addons for Elementor plugin \<= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jewel Theme Master Addons for Elementor)
- [CVE-2024-35689](https://cve.now/CVE-2024-35689.md): WordPress Analytify plugin \<= 5.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Analytify)
- [CVE-2024-35691](https://cve.now/CVE-2024-35691.md): WordPress Widget Options - Extended plugin \<= 5.1.0 - Multiple Data Exposure Vulnerability (CVSS 6.5, Marketing Fire Widget Options - Extended)
- [CVE-2024-35693](https://cve.now/CVE-2024-35693.md): WordPress 12 Step Meeting List plugin \<= 3.14.33 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AA Web Servant 12 Step Meeting List)
- [CVE-2024-35694](https://cve.now/CVE-2024-35694.md): WordPress WPMobile.App plugin \<= 11.41 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Amauri WPMobile.App)
- [CVE-2024-35695](https://cve.now/CVE-2024-35695.md): WordPress WP Docs plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fahad Mahmood WP Docs)
- [CVE-2024-35696](https://cve.now/CVE-2024-35696.md): WordPress WP Docs plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fahad Mahmood WP Docs)
- [CVE-2024-35697](https://cve.now/CVE-2024-35697.md): WordPress Eduma theme \<= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThimPress Eduma)
- [CVE-2024-35698](https://cve.now/CVE-2024-35698.md): WordPress YITH WooCommerce Tab Manager plugin \<= 1.35.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, YITHEMES YITH WooCommerce Tab Manager)
- [CVE-2024-35699](https://cve.now/CVE-2024-35699.md): WordPress HT Feed plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes HT Feed)
- [CVE-2024-35701](https://cve.now/CVE-2024-35701.md): WordPress PropertyHive plugin \<= 2.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PropertyHive)
- [CVE-2024-35702](https://cve.now/CVE-2024-35702.md): WordPress Master Addons for Elementor plugin \<= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jewel Theme Master Addons for Elementor)
- [CVE-2024-35703](https://cve.now/CVE-2024-35703.md): WordPress Sina Extension for Elementor plugin \<= 3.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SinaExtra Sina Extension for Elementor)
- [CVE-2024-35704](https://cve.now/CVE-2024-35704.md): WordPress BlockArt Blocks plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBlockArt BlockArt Blocks)
- [CVE-2024-35705](https://cve.now/CVE-2024-35705.md): WordPress Block for Font Awesome plugin \<= 1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ciprian Popescu Block for Font Awesome)
- [CVE-2024-35706](https://cve.now/CVE-2024-35706.md): WordPress Heateor Social Login WordPress plugin \<= 1.1.32 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Team Heateor Heateor Social Login)
- [CVE-2024-35707](https://cve.now/CVE-2024-35707.md): WordPress Heateor Social Login WordPress plugin \<= 1.1.32 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Team Heateor Heateor Social Login)
- [CVE-2024-35708](https://cve.now/CVE-2024-35708.md): WordPress Rife Free theme \<= 2.4.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, apollo13themes Rife Free)
- [CVE-2024-35709](https://cve.now/CVE-2024-35709.md): WordPress The Plus Addons for Elementor plugin \<= 5.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2024-35710](https://cve.now/CVE-2024-35710.md): WordPress Podlove Web Player plugin \<= 5.7.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Podlove Web Player)
- [CVE-2024-35711](https://cve.now/CVE-2024-35711.md): WordPress Event theme \<= 1.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Event)
- [CVE-2024-35713](https://cve.now/CVE-2024-35713.md): WordPress Testimonial Carousel For Elementor plugin \<= 10.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, UAPP GROUP Testimonial Carousel For Elementor)
- [CVE-2024-35714](https://cve.now/CVE-2024-35714.md): WordPress Idyllic theme \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Idyllic)
- [CVE-2024-35715](https://cve.now/CVE-2024-35715.md): WordPress Bloglo and Blogvi themes affected by Cross Site Scripting (XSS) vulnerability (CVSS 6.5, peregrinethemes Bloglo · peregrinethemes Blogvi)
- [CVE-2024-35718](https://cve.now/CVE-2024-35718.md): WordPress Newsletters plugin \<= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tribulant Newsletters)
- [CVE-2024-35719](https://cve.now/CVE-2024-35719.md): WordPress RestroPress plugin \<= 3.1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MagniGenie RestroPress)
- [CVE-2024-36970](https://cve.now/CVE-2024-36970.md): wifi: iwlwifi: Use request\_module\_nowait (no CVSS, Linux)
- [CVE-2024-35730](https://cve.now/CVE-2024-35730.md): WordPress Active Products Tables for WooCommerce plugin \<= 1.0.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realmag777 Active Products Tables for WooCommerce)
- [CVE-2024-35731](https://cve.now/CVE-2024-35731.md): WordPress Kenta Gutenberg Blocks plugin \<= 1.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Moose Kenta Gutenberg Blocks Responsive Blocks and block…)
- [CVE-2024-36969](https://cve.now/CVE-2024-36969.md): drm/amd/display: Fix division by zero in setup\_dsc\_config (no CVSS, Linux)
- [CVE-2024-36968](https://cve.now/CVE-2024-36968.md): Bluetooth: L2CAP: Fix div-by-zero in l2cap\_le\_flowctl\_init() (CVSS 7.6, Linux)
- [CVE-2024-36967](https://cve.now/CVE-2024-36967.md): KEYS: trusted: Fix memory leak in tpm2\_key\_encode() (no CVSS, Linux)
- [CVE-2024-36966](https://cve.now/CVE-2024-36966.md): erofs: reliably distinguish block based and fscache mode (no CVSS, Linux)
- [CVE-2024-36965](https://cve.now/CVE-2024-36965.md): remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (CVSS 7.8, Linux)
- [CVE-2024-35732](https://cve.now/CVE-2024-35732.md): WordPress YITH Custom Login plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, YITHEMES YITH Custom Login)
- [CVE-2024-35733](https://cve.now/CVE-2024-35733.md): WordPress Auto Coupons for WooCommerce plugin \<= 3.0.14 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RLDD Auto Coupons for WooCommerce)
- [CVE-2024-35734](https://cve.now/CVE-2024-35734.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CodePeople WP Time Slots Booking Form)
- [CVE-2024-35736](https://cve.now/CVE-2024-35736.md): WordPress Visualizer plugin \<= 3.11.1 - SQL Injection vulnerability (CVSS 8.5, Themeisle Visualizer)
- [CVE-2024-35737](https://cve.now/CVE-2024-35737.md): WordPress WP Visitors Tracker plugin \<= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Loopus WP Visitors Tracker)
- [CVE-2024-35738](https://cve.now/CVE-2024-35738.md): WordPress Kognetiks Chatbot for WordPress plugin \<= 1.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kognetiks Chatbot for WordPress)
- [CVE-2024-35739](https://cve.now/CVE-2024-35739.md): WordPress The Post Grid plugin \<= 7.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RadiusTheme The Post Grid)
- [CVE-2024-35740](https://cve.now/CVE-2024-35740.md): WordPress Pixgraphy theme \<= 1.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Theme Freesia Pixgraphy)
- [CVE-2024-35750](https://cve.now/CVE-2024-35750.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - SQL Injection vulnerability (CVSS 8.5, wpdevart Responsive Image Gallery, Gallery Album)
- [CVE-2024-35751](https://cve.now/CVE-2024-35751.md): WordPress Woody code snippets plugin \<= 2.4.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Creative Motion, Will Bontrager Software Woody ad snippets)
- [CVE-2024-35752](https://cve.now/CVE-2024-35752.md): WordPress Stellissimo Text Box plugin 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Enea Overclokk Stellissimo Text Box)
- [CVE-2024-5766](https://cve.now/CVE-2024-5766.md): Likeshop Merchandise admin cross site scripting (CVSS 5.1, Likeshop)
- [CVE-2024-35753](https://cve.now/CVE-2024-35753.md): WordPress TemplatesNext OnePager plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TemplatesNext OnePager)
- [CVE-2024-35755](https://cve.now/CVE-2024-35755.md): WordPress Weather Widget Pro plugin \<= 1.1.40 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, El tiempo Weather Widget Pro)
- [CVE-2024-35756](https://cve.now/CVE-2024-35756.md): WordPress Tooltip CK plugin \<= 2.2.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, CeiKay Tooltip CK)
- [CVE-2024-5654](https://cve.now/CVE-2024-5654.md): CF7 Google Sheets Connector \<= 5.0.9 - Missing Authorization to Limited Site Configuration Update (CVSS 6.5, westerndeal GSheetConnector for CF7 – Connect Contact Form…)
- [CVE-2024-4468](https://cve.now/CVE-2024-4468.md): Salon booking system \<= 9.9 - Missing Authorization (CVSS 4.3, wordpresschef Salon Booking System – Free Version)
- [CVE-2024-5091](https://cve.now/CVE-2024-5091.md): SKT Addons for Elementor \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider Widgets (CVSS 7.4, sonalsinha21 SKT Addons for Elementor)
- [CVE-2024-5613](https://cve.now/CVE-2024-5613.md): Formula \<= 0.5.1 - Reflected Cross-Site Scripting via quality\_customizer\_notify\_dismiss\_action (CVSS 6.1, awordpresslife Formula)
- [CVE-2024-5087](https://cve.now/CVE-2024-5087.md): Minimal Coming Soon – Coming Soon Page \<= 2.38 - Missing Authorization to Limited Settings Change (CVSS 6.3, webfactory Minimal Coming Soon – Coming Soon Page)
- [CVE-2024-5638](https://cve.now/CVE-2024-5638.md): Formula \<= 0.5.1 - Reflected Cross-Site Scripting via ti\_customizer\_notify\_dismiss\_recommended\_plugins (CVSS 6.1, awordpresslife Formula)
- [CVE-2024-4661](https://cve.now/CVE-2024-4661.md): WP Reset \<= 2.02 - Missing Authorization to License Key Modification (CVSS 4.3, webfactory WP Reset)
- [CVE-2024-5770](https://cve.now/CVE-2024-5770.md): WP Force SSL & HTTPS SSL Redirect \<= 1.66 - Missing Authorization to Settings Update (CVSS 4.2, webfactory WP Force SSL & HTTPS SSL Redirect)
- [CVE-2024-3668](https://cve.now/CVE-2024-3668.md): PowerPack Pro for Elementor \<= 2.10.17 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8, PowerPack Pro for Elementor)
- [CVE-2024-5663](https://cve.now/CVE-2024-5663.md): Cards for Beaver Builder \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget (CVSS 6.4, pratikchaskar Cards for Beaver Builder)
- [CVE-2024-37407](https://cve.now/CVE-2024-37407.md): Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. (CVSS 9.1)
- [CVE-2024-37408](https://cve.now/CVE-2024-37408.md): fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam\_fprintd (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.