# CVEs published 2024-06-29

16 CVEs were published on June 29, 2024: 2 critical, 4 high. Days are UTC.

- [CVE-2024-2386](https://cve.now/CVE-2024-2386.md): WordPress Plugin for Google Maps – WP MAPS \<= 4.6.1 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…)
- [CVE-2024-25943](https://cve.now/CVE-2024-25943.md): iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnera (CVSS 7.6, Integrated Dell Remote Access Controller)
- [CVE-2023-4017](https://cve.now/CVE-2023-4017.md): Goya \<= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters (CVSS 6.1, everthemess Goya)
- [CVE-2024-5819](https://cve.now/CVE-2024-5819.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-5790](https://cve.now/CVE-2024-5790.md): Happy Addons for Elementor \<= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-5666](https://cve.now/CVE-2024-5666.md): Extensions for Elementor \<= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (CVSS 6.4, petesheppard84 Extensions for Elementor)
- [CVE-2024-6363](https://cve.now/CVE-2024-6363.md): Stock Ticker \<= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock\_ticker Shortcode (CVSS 6.4, urkekg Stock Ticker)
- [CVE-2024-5598](https://cve.now/CVE-2024-5598.md): Advanced File Manager \<= 5.2.4 - Sensitive Information Exposure via Directory Listing (CVSS 7.5, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2024-5889](https://cve.now/CVE-2024-5889.md): Events Manager \<= 6.4.8 - Reflected Cross-Site Scripting (CVSS 6.1, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2024-6265](https://cve.now/CVE-2024-6265.md): UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress \<= 1.2.10 - Unauthenticated SQL Injection via 'uwp\_sort\_by' (CVSS 9.8, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2024-5192](https://cve.now/CVE-2024-5192.md): Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells \<= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4, amans2k FunnelKit – Funnel Builder for WooCommerce Checkout)
- [CVE-2024-5942](https://cve.now/CVE-2024-5942.md): Page and Post Clone \<= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure (CVSS 4.3, carlosfazenda Fast Page & Post Duplicator)
- [CVE-2024-6405](https://cve.now/CVE-2024-6405.md): Floating Social Buttons \<= 1.5 - Cross-Site Request Forgery (CVSS 6.1, bhagirath25 Floating Social Buttons)
- [CVE-2024-39840](https://cve.now/CVE-2024-39840.md): Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain (CVSS 8.8)
- [CVE-2024-39846](https://cve.now/CVE-2024-39846.md): NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensiti (CVSS 3.5)
- [CVE-2024-39848](https://cve.now/CVE-2024-39848.md): Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.