CVEs published June 9, 2024
107 CVEs were published on June 9, 2024: 3 critical, 25 high. 1 is now in CISA KEV.
- Published
- 107
- Critical
- 3
- High
- 25
- Medium
- 78
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- PHP Group PHP
- 4
- 8theme XStore
- 3
- reputeinfosystems ARForms
- 3
- AA-Team WZone
- 2
- Awesome Support Team Awesome Support
- 2
- Bricksforge
- 2
- Netentsec NS-ASG Application Security Gateway
- 2
- Pluggabl Booster Plus for WooCommerce
- 2
- WPDeveloper EmbedPress
- 2
- 8theme XStore Core
- 1
Critical 3
- CVE-2024-4577Argument Injection in PHP-CGIPHP Group PHP
- CVE-2024-33565WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Broken Access Control vulnerabilityUkrSolution Barcode Scanner with Inventory & Order Manager
- CVE-2024-31244WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerabilityBricksforge
High 25
- CVE-2024-5585Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)PHP Group PHP
- CVE-2024-31275WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerabilityMetagauss EventPrime
- CVE-2024-31283WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerabilityzorem Advanced Local Pickup for WooCommerce
- CVE-2024-31304WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerabilityMultiVendorX WC Marketplace
- CVE-2024-32703WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerabilityreputeinfosystems ARForms
- CVE-2024-32704WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerabilityreputeinfosystems ARForms
- CVE-2024-32705WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerabilityreputeinfosystems ARForms
- CVE-2024-32715WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerabilityOlive Themes Olive One Click Demo Import
- CVE-2024-32777WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerabilityBizSwoop a CPF Concepts, LLC Brand BizPrint
- CVE-2024-32778WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2024-32798WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerabilityWP Travel Engine
- CVE-2024-33543WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form
- CVE-2024-33547WordPress WZone plugin <= 14.0.10 - Site Wide Broken Access Control vulnerabilityAA-Team WZone
- CVE-2024-33555WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability8theme XStore Core
- CVE-2024-33561WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability8theme XStore
- CVE-2024-33563WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability8theme XStore
- CVE-2024-33564WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability8theme XStore
- CVE-2024-31243WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerabilityBricksforge
- CVE-2024-30485WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerabilityXLPlugins Finale Lite
- CVE-2024-25092WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerabilityXLPlugins NextMove Lite
- CVE-2023-31080WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerabilityUnlimited Elements For Elementor
- CVE-2024-31098WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerabilityMr.Ebabi New Order Notification for Woocommerce
- CVE-2024-37568lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.authlib
- CVE-2024-37569An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices.
- CVE-2024-37570On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path param
Medium, low and unrated 79
- CVE-2024-5389Insufficient Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2408PHP is vulnerable to the Marvin AttackPHP Group PHP
- CVE-2024-35748WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerabilityOPMC WooCommerce Dropshipping
- CVE-2024-32081WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - Broken Access Control vulnerabilityWebsupporter Filter Custom Fields & Taxonomies Light
- CVE-2024-34802WordPress AdFoxly plugin <= 1.8.5 - Broken Access Control vulnerabilityAdFoxly – Ad Manager, AdSense Ads & Ads.txt
- CVE-2024-35661WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerabilitySoftLab Upload Fields for WPForms
- CVE-2024-35662WordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerabilityAndreas Sofantzis Simple COD Fees for WooCommerce
- CVE-2024-5458Filter bypass in filter_var (FILTER_VALIDATE_URL)PHP Group PHP
- CVE-2024-31276WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerabilityWPFactory Products, Order & Customers Export for WooCommerce
- CVE-2024-31284WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerabilityWPDeveloper EmbedPress
- CVE-2024-31307WordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerabilityappscreo Easy Social Share Buttons
- CVE-2024-31347WordPress Tracking Code Manager plugin <= 2.1.0 - Broken Access Control vulnerabilityData443 Tracking Code Manager
- CVE-2024-31350WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerabilityAWP Classifieds Team AWP Classifieds
- CVE-2024-31352WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerabilityEmail Subscribers & Newsletters
- CVE-2024-31359WordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerabilityPremmerce Product Filter for WooCommerce
- CVE-2024-32701WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerabilityInstaWP Connect
- CVE-2024-31423WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerabilityAlex Volkov WP Accessibility Helper
- CVE-2024-32713WordPress AI Post Generator | AutoWriter plugin <= 3.3 - Broken Access Control vulnerabilityAI Post Generator | AutoWriter
- CVE-2024-32714WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerabilityAcademy LMS
- CVE-2024-32725WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerabilitySaleswonder Team: Tobias 5 Stars Rating Funnel
- CVE-2024-32727WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerabilityRomethemeForm For Elementor
- CVE-2024-32779WordPress Vision – Image Map Builder plugin <= 1.7.1 - Broken Access Control vulnerabilityAvirtum Vision Interactive
- CVE-2024-32783WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilitywpcreativeidea Advanced Testimonial Carousel for Elementor
- CVE-2024-32784WordPress CookieHub plugin <= 1.1.0 - Broken Access Control vulnerabilityCookieHub
- CVE-2024-32787WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerabilityCopy Content Protection Team Secure Copy Content Protection…
- CVE-2024-32792WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hummingbird
- CVE-2024-32797WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerabilityMartin Gibson WP LinkedIn Auto Publish
- CVE-2024-32799WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerabilityMerv Barrett Easy Property Listings
- CVE-2024-32804WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerabilityMartin Gibson WP GoToWebinar
- CVE-2024-32805WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerabilitySocial Snap
- CVE-2024-32811WordPress USPS Shipping for WooCommerce – Live Rates plugin <= 1.9.4 - Sensitive Data Exposure via Log File vulnerabilityOctolize USPS Shipping for WooCommerce – Live Rates
- CVE-2024-32813WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerabilitySoftLab Integrate Google Drive
- CVE-2024-32814WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerabilityZorem Advanced Local Pickup for WooCommerce
- CVE-2024-32818WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-32820WordPress Social Share Icons & Social Share Buttons plugin <= 3.6.2 - Broken Access Control lead to Notice Dismissal vulnerabilitySocial Share Pro Social Share Icons & Social Share Buttons
- CVE-2024-32821WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerabilityTotalSuite Total Poll Lite
- CVE-2023-45188IBM Engineering Lifecycle Optimization Publishing file uploadIBM Engineering Lifecycle Optimization Publishing
- CVE-2024-32824WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerabilityEvergreen Content Poster
- CVE-2024-33545WordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerabilityAA-Team WZone
- CVE-2024-33572WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerabilityPOSIMYTH Nexter Blocks
- CVE-2024-34435WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerabilityCodeRevolution Aiomatic
- CVE-2024-35660WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerabilityJewel Theme Master Addons for Elementor
- CVE-2024-35669WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerabilityBowo Debug Log Manager
- CVE-2024-31274WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerabilityWPDeveloper EmbedPress
- CVE-2024-31273WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerabilityJS Help Desk – Best Help Desk & Support Plugin
- CVE-2024-31267WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerabilityWP Desk Flexible Checkout Fields for WooCommerce
- CVE-2024-31261WordPress Announcer – Notification & message bars plugin <= 6.0 - Broken Access Control vulnerabilityAakash Chakravarthy Announcer – Notification & message bars
- CVE-2024-31252WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerabilitydFactory Responsive Lightbox
- CVE-2024-31248WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerabilityTeam Plugins360 All-in-One Video Gallery
- CVE-2024-30544WordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerabilityUPQODE Whizzy
- CVE-2024-30529WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerabilityTainacan
- CVE-2024-30517WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerabilitySliced Invoices
- CVE-2024-30515WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerabilityPixelite Events Manager
- CVE-2024-30512WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerabilityweForms
- CVE-2024-30481WordPress JCH Optimize plugin <= 4.0.0 - Broken Access Control vulnerabilitySamuel Marshall JCH Optimize
- CVE-2024-30470WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerabilityYITH WooCommerce Account Funds Premium
- CVE-2024-30467WordPress Essential Blocks plugin <= 4.4.9 - Broken Access Control vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2024-30466WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerabilityOnTheGoSystems WooCommerce Multilingual & Multicurrency
- CVE-2024-30465WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerabilityPagelayer Team PageLayer
- CVE-2024-30464WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerabilitySocial Icons Widget & Block by WPZOOM
- CVE-2024-25929WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerabilityProduct Catalog Enquiry for WooCommerce by MultiVendorX
- CVE-2024-24716WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerabilityAwesome Support Team Awesome Support
- CVE-2023-34003WordPress WooCommerce Box Office plugin <= 1.1.51 - Unauthenticated Save Ticket Barcode vulnerabilityWooCommerce Box Office
- CVE-2023-23640WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 - Subscriber+ Arbitrary Plugin Activation VulnerabilityMainWP UpdraftPlus Extension
- CVE-2023-23639WordPress MainWP Staging Extension Plugin <= 4.0.3 - Subscriber+ Arbitrary Plugin Activation VulnerabilityMainWP Staging Extension
- CVE-2023-51494WordPress WooCommerce Product Vendors plugin <= 2.2.1 - Broken Access Control vulnerabilityWooCommerce Product Vendors
- CVE-2023-52230WordPress Booster Plus for WooCommerce plugin < 7.1.3 - Authenticated Arbitrary WordPress Option Disclosure VulnerabilityPluggabl Booster Plus for WooCommerce
- CVE-2023-52232WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Authenticated Arbitrary Post/Page Deletion VulnerabilityPluggabl Booster Plus for WooCommerce
- CVE-2024-30539WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerabilityAwesome Support Team Awesome Support
- CVE-2024-30534WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerabilitytypps Calendarista Basic Edition
- CVE-2024-30537WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerabilityWPClever WPC Badge Management for WooCommerce
- CVE-2024-30538WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerabilityDELUCKS SEO
- CVE-2024-31246WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerabilityWPXPO PostX
- CVE-2024-31294WordPress WP Sort Order plugin <= 1.3.1 - Broken Access Control vulnerabilityFahad Mahmood WP Sort Order
- CVE-2024-5775SourceCodester Vehicle Management System updatebill.php sql injectionSourceCodester Vehicle Management System
- CVE-2024-5774SourceCodester Stock Management System Login index.php sql injectionSourceCodester Stock Management System
- CVE-2024-5773Netentsec NS-ASG Application Security Gateway deletemacbind.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-5772Netentsec NS-ASG Application Security Gateway deleteiscuser.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-37535GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related