# CVEs published 2024-11-09

195 CVEs were published on November 9, 2024: 11 critical, 86 high. Days are UTC.

- [CVE-2024-52032](https://cve.now/CVE-2024-52032.md): Private channel names leaking when Elasticsearch is enabled (CVSS 4.3, Mattermost)
- [CVE-2024-36250](https://cve.now/CVE-2024-36250.md): MFA Code Replay (CVSS 3.1, Mattermost)
- [CVE-2024-42000](https://cve.now/CVE-2024-42000.md): Unauthorized Access to view channels' details (CVSS 2.7, Mattermost)
- [CVE-2024-51585](https://cve.now/CVE-2024-51585.md): WordPress Sales Page Addon plugin \<= 1.4.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Sales Page Addon – Elementor & Beaver Builder)
- [CVE-2024-51586](https://cve.now/CVE-2024-51586.md): WordPress Elementary Addons plugin \<= 2.0.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, camilluskillus Elementary Addons)
- [CVE-2024-51587](https://cve.now/CVE-2024-51587.md): WordPress Definitive Addons for Elementor plugin \<= 1.5.16 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, softfirm Definitive Addons for Elementor)
- [CVE-2024-51588](https://cve.now/CVE-2024-51588.md): WordPress Super Addons for Elementor plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, riponhossain Super Addons for Elementor)
- [CVE-2024-51589](https://cve.now/CVE-2024-51589.md): WordPress Bigmart Elements plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpcirqle Bigmart Elements)
- [CVE-2024-51590](https://cve.now/CVE-2024-51590.md): WordPress Hoo Addons for Elementor plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HooThemes Hoo Addons for Elementor)
- [CVE-2024-51591](https://cve.now/CVE-2024-51591.md): WordPress Slicko plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Grids Slicko)
- [CVE-2024-51592](https://cve.now/CVE-2024-51592.md): WordPress Meta Store Elements plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mystical Themes Meta Store Elements)
- [CVE-2024-51593](https://cve.now/CVE-2024-51593.md): WordPress Курс валют UAH plugin \<= 2.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Glopium Курс валют UAH)
- [CVE-2024-51594](https://cve.now/CVE-2024-51594.md): WordPress Gmap Point List plugin \<= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rafel.sanso Gmap Point List)
- [CVE-2024-51595](https://cve.now/CVE-2024-51595.md): WordPress SKSDEV Toolkit plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKSDEV Toolkit)
- [CVE-2024-51596](https://cve.now/CVE-2024-51596.md): WordPress Business plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nilesh Shiragave Business)
- [CVE-2024-51597](https://cve.now/CVE-2024-51597.md): WordPress ThemeShark Templates & Widgets for Elementor plugin \<= 1.1.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeShark Templates & Widgets for Elementor)
- [CVE-2024-51598](https://cve.now/CVE-2024-51598.md): WordPress Selar.co Widget plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kendysond Selar.co Widget)
- [CVE-2024-51599](https://cve.now/CVE-2024-51599.md): WordPress Simple Business Manager plugin \<= 4.6.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, russell.albin Simple Business Manager)
- [CVE-2024-51603](https://cve.now/CVE-2024-51603.md): WordPress NMR Strava activities plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mirceatm NMR Strava activities)
- [CVE-2024-51604](https://cve.now/CVE-2024-51604.md): WordPress Media Modal plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cmabugay Media Modal)
- [CVE-2024-51605](https://cve.now/CVE-2024-51605.md): WordPress Genoo plugin \<= 6.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Genoo)
- [CVE-2024-51606](https://cve.now/CVE-2024-51606.md): WordPress Blrt WP Embed plugin \<= 1.6.9 - SQL Injection vulnerability (CVSS 8.5, Blrt WP Embed)
- [CVE-2024-51608](https://cve.now/CVE-2024-51608.md): WordPress AmaDiscount Plugin plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, colinph970 AmaDiscount)
- [CVE-2024-51609](https://cve.now/CVE-2024-51609.md): WordPress Emoji Shortcode plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aakif Kadiwala Emoji Shortcode)
- [CVE-2024-51610](https://cve.now/CVE-2024-51610.md): WordPress Display Terms Shortcode plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, seothemes Display Terms Shortcode)
- [CVE-2024-51611](https://cve.now/CVE-2024-51611.md): WordPress WP Feature Box plugin \<= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Miguel Peixe WP Feature Box)
- [CVE-2024-51612](https://cve.now/CVE-2024-51612.md): WordPress Reftagger Shortcode plugin \<= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, designerken Reftagger Shortcode)
- [CVE-2024-51613](https://cve.now/CVE-2024-51613.md): WordPress TradeMe widgets plugin \<= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bidbud TradeMe widgets)
- [CVE-2024-51614](https://cve.now/CVE-2024-51614.md): WordPress Aajoda Testimonials plugin \<= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aajoda Testimonials)
- [CVE-2024-51616](https://cve.now/CVE-2024-51616.md): WordPress AwesomePress plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rupok AwesomePress)
- [CVE-2024-51618](https://cve.now/CVE-2024-51618.md): WordPress Custom Admin Menu plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DuoGeek Custom Admin Menu)
- [CVE-2024-51622](https://cve.now/CVE-2024-51622.md): WordPress WP EASY RECIPE plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP-EXPERTS.IN WP EASY RECIPE)
- [CVE-2024-51623](https://cve.now/CVE-2024-51623.md): WordPress WP EIS plugin \<= 1.3.3 - SQL Injection vulnerability (CVSS 8.5, mehral WP EIS)
- [CVE-2024-51627](https://cve.now/CVE-2024-51627.md): WordPress Audio Comparison Lite plugin \<= 3.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kaedinger Audio Comparison Lite)
- [CVE-2024-51628](https://cve.now/CVE-2024-51628.md): WordPress EzyOnlineBookings Online Booking System Widget plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EzyOnlineBookings Online Booking System Widget)
- [CVE-2024-51629](https://cve.now/CVE-2024-51629.md): WordPress Header Footer Composer for Elementor plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MetricThemes Header Footer Composer for Elementor)
- [CVE-2024-51630](https://cve.now/CVE-2024-51630.md): WordPress Responsive Flickr Gallery plugin \<= 1.3.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Lars Schenk Responsive Flickr Gallery)
- [CVE-2024-51647](https://cve.now/CVE-2024-51647.md): WordPress Featured Posts Scroll plugin \<= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chaser324 Featured Posts Scroll)
- [CVE-2024-51662](https://cve.now/CVE-2024-51662.md): WordPress Black Widgets For Elementor plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Modernaweb Studio Black Widgets For Elementor)
- [CVE-2024-51663](https://cve.now/CVE-2024-51663.md): WordPress Bricksable for Bricks Builder plugin \<= 1.6.59 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Bricksable for Bricks Builder)
- [CVE-2024-51664](https://cve.now/CVE-2024-51664.md): WordPress Beds24 Online Booking plugin \<= 2.0.25 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, markkinchin Beds24 Online Booking)
- [CVE-2024-51668](https://cve.now/CVE-2024-51668.md): WordPress MyCurator Content Curation plugin \<= 3.78 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, mtilly MyCurator Content Curation)
- [CVE-2024-51670](https://cve.now/CVE-2024-51670.md): WordPress JS Help Desk plugin \<= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, JoomSky JS Help Desk)
- [CVE-2024-51673](https://cve.now/CVE-2024-51673.md): WordPress HT Politic plugin \<= 2.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DevItems HT Politic)
- [CVE-2024-51674](https://cve.now/CVE-2024-51674.md): WordPress Sastra Essential Addons for Elementor plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fast Themes Sastra Essential Addons for Elementor)
- [CVE-2024-51675](https://cve.now/CVE-2024-51675.md): WordPress aThemes Addons for Elementor plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Syed Balkhi aThemes Addons for Elementor)
- [CVE-2024-51676](https://cve.now/CVE-2024-51676.md): WordPress Delisho plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Delicious Delisho)
- [CVE-2024-51689](https://cve.now/CVE-2024-51689.md): WordPress CF7 WOW Styler plugin \<= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saleswonder Team: Tobias CF7 WOW Styler)
- [CVE-2024-51690](https://cve.now/CVE-2024-51690.md): WordPress Wp Slide Categorywise plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, neelam.samariya Wp Slide Categorywise)
- [CVE-2024-51691](https://cve.now/CVE-2024-51691.md): WordPress Admin Amplify plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aryanduntley Admin Amplify)
- [CVE-2024-51692](https://cve.now/CVE-2024-51692.md): WordPress Bing Search API Integration plugin \<= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, askewbrook Bing Search API Integration)
- [CVE-2024-51693](https://cve.now/CVE-2024-51693.md): WordPress Search order by product SKU for WooCommerce plugin \<= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, labdav Search order by product SKU for WooCommerce)
- [CVE-2024-51694](https://cve.now/CVE-2024-51694.md): WordPress Geotagged Media plugin \<= 0.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, digitalfisherman Geotagged Media)
- [CVE-2024-51695](https://cve.now/CVE-2024-51695.md): WordPress Fabrica Synced Pattern Instances plugin \<= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yes We Work Fabrica Synced Pattern Instances)
- [CVE-2024-51696](https://cve.now/CVE-2024-51696.md): WordPress Content Syndication Toolkit Reader plugin \<= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ben.moody Content Syndication Toolkit Reader)
- [CVE-2024-51697](https://cve.now/CVE-2024-51697.md): WordPress Doofinder plugin \<= 0.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Doofinder)
- [CVE-2024-51698](https://cve.now/CVE-2024-51698.md): WordPress Master Bar plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Luis Rock Master Bar)
- [CVE-2024-51699](https://cve.now/CVE-2024-51699.md): WordPress Buooy Sticky Header plugin \<= 0.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Buooy Sticky Header)
- [CVE-2024-51701](https://cve.now/CVE-2024-51701.md): WordPress MG Post Contributors plugin \<= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mahesh Waghmare MG Post Contributors)
- [CVE-2024-51702](https://cve.now/CVE-2024-51702.md): WordPress SrcSet Responsive Images for WordPress plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ben.moody SrcSet Responsive Images for WordPress)
- [CVE-2024-10837](https://cve.now/CVE-2024-10837.md): SysBasics Customize My Account for WooCommerce \<= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter (CVSS 6.1, phppoet SysBasics Customize My Account for WooCommerce)
- [CVE-2024-51703](https://cve.now/CVE-2024-51703.md): WordPress WP-Basics plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, laura20 WP-Basics)
- [CVE-2024-51704](https://cve.now/CVE-2024-51704.md): WordPress imPress plugin \<= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, John Hanusek imPress)
- [CVE-2024-51705](https://cve.now/CVE-2024-51705.md): WordPress WP MMenu Lite plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jamesdbruner WP MMenu Lite)
- [CVE-2024-51706](https://cve.now/CVE-2024-51706.md): WordPress UW Freelancer plugin \<= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Upeksha Wisidagama UW Freelancer)
- [CVE-2024-51707](https://cve.now/CVE-2024-51707.md): WordPress WP Visual Adverts plugin \<= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WebCodin WP Visual Adverts)
- [CVE-2024-51708](https://cve.now/CVE-2024-51708.md): WordPress Narnoo Commerce Manager plugin \<= 1.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Narnoo Commerce Manager)
- [CVE-2024-51709](https://cve.now/CVE-2024-51709.md): WordPress TeleAdmin plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mariandz TeleAdmin)
- [CVE-2024-51710](https://cve.now/CVE-2024-51710.md): WordPress Responsive Data Table plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Minerva Infotech Responsive Data Table)
- [CVE-2024-51711](https://cve.now/CVE-2024-51711.md): WordPress Saragna plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hitesh Khunt Saragna)
- [CVE-2024-51712](https://cve.now/CVE-2024-51712.md): WordPress Jigoshop plugin \<= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Michael Visser Jigoshop – Store Toolkit)
- [CVE-2024-51713](https://cve.now/CVE-2024-51713.md): WordPress HQ60 Fidelity Card plugin \<= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TRe Technology And Research S.r.l. HQ60 Fidelity Card)
- [CVE-2024-51714](https://cve.now/CVE-2024-51714.md): WordPress User Password Reset plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, techdabang User Password Reset)
- [CVE-2024-51716](https://cve.now/CVE-2024-51716.md): WordPress Twitter real time search scrolling plugin \<= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, gopiplus Twitter real time search scrolling)
- [CVE-2024-51717](https://cve.now/CVE-2024-51717.md): WordPress Ajax Content Filter plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Perception System System Pvt. Ajax Content Filter)
- [CVE-2024-51718](https://cve.now/CVE-2024-51718.md): WordPress Simple Modal plugin \<= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, arsdehnel Simple Modal)
- [CVE-2024-51719](https://cve.now/CVE-2024-51719.md): WordPress Simplistic SEO plugin \<= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Roman Peterhans Simplistic SEO)
- [CVE-2024-51759](https://cve.now/CVE-2024-51759.md): WordPress SVT Simple plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Detlef Beyer SVT Simple)
- [CVE-2024-51760](https://cve.now/CVE-2024-51760.md): WordPress Dashing Memberships plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ristretto Apps Dashing Memberships)
- [CVE-2024-51761](https://cve.now/CVE-2024-51761.md): WordPress WPHelpful plugin \<= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zackgilbert WPHelpful)
- [CVE-2024-10352](https://cve.now/CVE-2024-10352.md): Magical Addons For Elementor \<= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3, nalam-1 Magical Addons For Elementor)
- [CVE-2024-10261](https://cve.now/CVE-2024-10261.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, cozmoslabs Paid Membership Subscriptions – Effortless Membe…)
- [CVE-2024-10640](https://cve.now/CVE-2024-10640.md): The FOX – Currency Switcher Professional for WooCommerce \<= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2024-50262](https://cve.now/CVE-2024-50262.md): bpf: Fix out-of-bounds write in trie\_get\_next\_key() (CVSS 7.8, Linux)
- [CVE-2024-50261](https://cve.now/CVE-2024-50261.md): macsec: Fix use-after-free while sending the offloading packet (CVSS 7.8, Linux)
- [CVE-2024-50260](https://cve.now/CVE-2024-50260.md): sock\_map: fix a NULL pointer dereference in sock\_map\_link\_update\_prog() (CVSS 4.7, Linux)
- [CVE-2024-50259](https://cve.now/CVE-2024-50259.md): netdevsim: Add trailing zero to terminate the string in nsim\_nexthop\_bucket\_activity\_write() (CVSS 5.5, Linux)
- [CVE-2024-50258](https://cve.now/CVE-2024-50258.md): net: fix crash when config small gso\_max\_size/gso\_ipv4\_max\_size (no CVSS, Linux)
- [CVE-2024-50257](https://cve.now/CVE-2024-50257.md): netfilter: Fix use-after-free in get\_info() (CVSS 7.0, Linux)
- [CVE-2024-50256](https://cve.now/CVE-2024-50256.md): netfilter: nf\_reject\_ipv6: fix potential crash in nf\_send\_reset6() (CVSS 7.5, Linux)
- [CVE-2024-50255](https://cve.now/CVE-2024-50255.md): Bluetooth: hci: fix null-ptr-deref in hci\_read\_supported\_codecs (CVSS 5.5, Linux)
- [CVE-2024-50254](https://cve.now/CVE-2024-50254.md): bpf: Free dynamically allocated bits in bpf\_iter\_bits\_destroy() (CVSS 5.5, Linux)
- [CVE-2024-50253](https://cve.now/CVE-2024-50253.md): bpf: Check the validity of nr\_words in bpf\_iter\_bits\_new() (CVSS 7.8, Linux)
- [CVE-2024-50252](https://cve.now/CVE-2024-50252.md): mlxsw: spectrum\_ipip: Fix memory leak when changing remote IPv6 address (CVSS 5.5, Linux)
- [CVE-2024-50251](https://cve.now/CVE-2024-50251.md): netfilter: nft\_payload: sanitize offset and length before calling skb\_checksum() (no CVSS, Linux)
- [CVE-2024-50250](https://cve.now/CVE-2024-50250.md): fsdax: dax\_unshare\_iter needs to copy entire blocks (CVSS 7.8, Linux)
- [CVE-2024-50249](https://cve.now/CVE-2024-50249.md): ACPI: CPPC: Make rmw\_lock a raw\_spin\_lock (CVSS 5.5, Linux)
- [CVE-2024-50248](https://cve.now/CVE-2024-50248.md): ntfs3: Add bounds checking to mi\_enum\_attr() (CVSS 7.1, Linux)
- [CVE-2024-50247](https://cve.now/CVE-2024-50247.md): fs/ntfs3: Check if more than chunk-size bytes are written (CVSS 7.3, Linux)
- [CVE-2024-50246](https://cve.now/CVE-2024-50246.md): fs/ntfs3: Add rough attr alloc\_size check (CVSS 7.8, Linux)
- [CVE-2024-50245](https://cve.now/CVE-2024-50245.md): fs/ntfs3: Fix possible deadlock in mi\_read (CVSS 5.5, Linux)
- [CVE-2024-50244](https://cve.now/CVE-2024-50244.md): fs/ntfs3: Additional check in ni\_clear() (CVSS 5.5, Linux)
- [CVE-2024-50243](https://cve.now/CVE-2024-50243.md): fs/ntfs3: Fix general protection fault in run\_is\_mapped\_full (no CVSS, Linux)
- [CVE-2024-50242](https://cve.now/CVE-2024-50242.md): fs/ntfs3: Additional check in ntfs\_file\_release (no CVSS, Linux)
- [CVE-2024-50241](https://cve.now/CVE-2024-50241.md): NFSD: Initialize struct nfsd4\_copy earlier (CVSS 7.5, Linux)
- [CVE-2024-50240](https://cve.now/CVE-2024-50240.md): phy: qcom: qmp-usb: fix NULL-deref on runtime suspend (CVSS 5.5, Linux)
- [CVE-2024-50239](https://cve.now/CVE-2024-50239.md): phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspend (CVSS 5.5, Linux)
- [CVE-2024-50238](https://cve.now/CVE-2024-50238.md): phy: qcom: qmp-usbc: fix NULL-deref on runtime suspend (CVSS 5.5, Linux)
- [CVE-2024-50237](https://cve.now/CVE-2024-50237.md): wifi: mac80211: do not pass a stopped vif to the driver in .get\_txpower (CVSS 7.8, Linux)
- [CVE-2024-50236](https://cve.now/CVE-2024-50236.md): wifi: ath10k: Fix memory leak in management tx (CVSS 5.5, Linux)
- [CVE-2024-50235](https://cve.now/CVE-2024-50235.md): wifi: cfg80211: clear wdev-\>cqm\_config pointer on free (CVSS 7.8, Linux)
- [CVE-2024-50234](https://cve.now/CVE-2024-50234.md): wifi: iwlegacy: Clear stale interrupts before resuming device (CVSS 7.0, Linux)
- [CVE-2024-50233](https://cve.now/CVE-2024-50233.md): staging: iio: frequency: ad9832: fix division by zero in ad9832\_calc\_freqreg() (CVSS 5.5, Linux)
- [CVE-2024-50232](https://cve.now/CVE-2024-50232.md): iio: adc: ad7124: fix division by zero in ad7124\_set\_channel\_odr() (CVSS 5.5, Linux)
- [CVE-2024-50231](https://cve.now/CVE-2024-50231.md): iio: gts-helper: Fix memory leaks in iio\_gts\_build\_avail\_scale\_table() (CVSS 5.5, Linux)
- [CVE-2024-50230](https://cve.now/CVE-2024-50230.md): nilfs2: fix kernel bug due to missing clearing of checked flag (CVSS 7.8, Linux)
- [CVE-2024-50229](https://cve.now/CVE-2024-50229.md): nilfs2: fix potential deadlock with newly created symlinks (CVSS 5.5, Linux)
- [CVE-2024-50227](https://cve.now/CVE-2024-50227.md): thunderbolt: Fix KASAN reported stack out-of-bounds read in tb\_retimer\_scan() (CVSS 7.1, Linux)
- [CVE-2024-50226](https://cve.now/CVE-2024-50226.md): cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CVSS 7.8, Linux)
- [CVE-2024-50225](https://cve.now/CVE-2024-50225.md): btrfs: fix error propagation of split bios (CVSS 7.8, Linux)
- [CVE-2024-50224](https://cve.now/CVE-2024-50224.md): spi: spi-fsl-dspi: Fix crash when not using GPIO chip select (CVSS 5.5, Linux)
- [CVE-2024-50223](https://cve.now/CVE-2024-50223.md): sched/numa: Fix the potential null pointer dereference in task\_numa\_work() (CVSS 5.5, Linux)
- [CVE-2024-50222](https://cve.now/CVE-2024-50222.md): iov\_iter: fix copy\_page\_from\_iter\_atomic() if KMAP\_LOCAL\_FORCE\_MAP (CVSS 7.0, Linux)
- [CVE-2024-50221](https://cve.now/CVE-2024-50221.md): drm/amd/pm: Vangogh: Fix kernel memory out of bounds write (CVSS 7.8, Linux)
- [CVE-2024-50220](https://cve.now/CVE-2024-50220.md): fork: do not invoke uffd on fork if error occurs (no CVSS, Linux)
- [CVE-2024-50218](https://cve.now/CVE-2024-50218.md): ocfs2: pass u64 to ocfs2\_truncate\_inline maybe overflow (no CVSS, Linux)
- [CVE-2024-50217](https://cve.now/CVE-2024-50217.md): btrfs: fix use-after-free of block device file in \_\_btrfs\_free\_extra\_devids() (CVSS 7.8, Linux)
- [CVE-2024-50216](https://cve.now/CVE-2024-50216.md): xfs: fix finding a last resort AG in xfs\_filestream\_pick\_ag (no CVSS, Linux)
- [CVE-2024-50215](https://cve.now/CVE-2024-50215.md): nvmet-auth: assign dh\_key to NULL after kfree\_sensitive (CVSS 8.1, Linux)
- [CVE-2024-50214](https://cve.now/CVE-2024-50214.md): drm/connector: hdmi: Fix memory leak in drm\_display\_mode\_from\_cea\_vic() (CVSS 5.5, Linux)
- [CVE-2024-50213](https://cve.now/CVE-2024-50213.md): drm/tests: hdmi: Fix memory leaks in drm\_display\_mode\_from\_cea\_vic() (CVSS 5.5, Linux)
- [CVE-2024-50212](https://cve.now/CVE-2024-50212.md): lib: alloc\_tag\_module\_unload must wait for pending kfree\_rcu calls (no CVSS, Linux)
- [CVE-2024-51762](https://cve.now/CVE-2024-51762.md): WordPress PropertyShift plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chris Gipple PropertyShift)
- [CVE-2024-51763](https://cve.now/CVE-2024-51763.md): WordPress Team Showcase and Slider plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, biplob018 Team Showcase and Slider – Team Members Builder)
- [CVE-2024-10676](https://cve.now/CVE-2024-10676.md): WordPress Conversion Helper plugin \<= 1.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wojciechborowicz Conversion Helper)
- [CVE-2024-51776](https://cve.now/CVE-2024-51776.md): WordPress Daily Image plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sam Hotchkiss Daily Image)
- [CVE-2024-51778](https://cve.now/CVE-2024-51778.md): WordPress Satisfaction Reports from Help Scout plugin \<= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tevya Satisfaction Reports from Help Scout)
- [CVE-2024-51779](https://cve.now/CVE-2024-51779.md): WordPress Don't Break The Code plugin \<= .3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jason Coleman Don't Break The Code)
- [CVE-2024-51780](https://cve.now/CVE-2024-51780.md): WordPress eewee admin custom plugin \<= 1.8.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, eewee admin custom)
- [CVE-2024-51781](https://cve.now/CVE-2024-51781.md): WordPress Firework Shoppable Live Video plugin \<= 6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Stefan Backor Firework Shoppable Live Video)
- [CVE-2024-50524](https://cve.now/CVE-2024-50524.md): WordPress Administrator Z plugin \< 2024.10.21 - SQL Injection vulnerability (CVSS 8.5, Quý Lê 91 Administrator Z)
- [CVE-2024-50539](https://cve.now/CVE-2024-50539.md): WordPress Lodgix.com Vacation Rental Website Builder plugin \<= 3.9.73 - SQL Injection vulnerability (CVSS 8.5, Lodgix.com Vacation Rental Website Builder)
- [CVE-2024-50544](https://cve.now/CVE-2024-50544.md): WordPress RSVP ME plugin \<= 1.9.9 - SQL Injection vulnerability (CVSS 8.5, MicahBlu RSVP ME)
- [CVE-2024-51570](https://cve.now/CVE-2024-51570.md): WordPress Easy Gallery plugin \<= 1.4 - SQL Injection vulnerability (CVSS 8.5, odihost Easy Gallery)
- [CVE-2024-51579](https://cve.now/CVE-2024-51579.md): WordPress 5 Stars Rating Funnel plugin \<=1.4.01 - SQL Injection vulnerability (CVSS 8.5, Saleswonder Team: Tobias 5 Stars Rating Funnel)
- [CVE-2024-51601](https://cve.now/CVE-2024-51601.md): WordPress Website price calculator plugin \<= 4.1 - SQL Injection vulnerability (CVSS 8.5, Maksym Marko Website price calculator)
- [CVE-2024-51602](https://cve.now/CVE-2024-51602.md): WordPress Simple Job Manager plugin \<= 1.1 - SQL Injection vulnerability (CVSS 8.5, oleksandr87 Simple Job Manager)
- [CVE-2024-51607](https://cve.now/CVE-2024-51607.md): WordPress Golf Tracker plugin \<= 0.7 - SQL Injection vulnerability (CVSS 8.5, percent20 Golf Tracker)
- [CVE-2024-51619](https://cve.now/CVE-2024-51619.md): WordPress Market 360 Viewer plugin \<= 1.01 - SQL Injection vulnerability (CVSS 8.5, market360 Market 360 Viewer)
- [CVE-2024-51620](https://cve.now/CVE-2024-51620.md): WordPress Porsline plugin \<= 1.0.2 - SQL Injection vulnerability (CVSS 8.5, Porsline)
- [CVE-2024-51621](https://cve.now/CVE-2024-51621.md): WordPress Download-Mirror-Counter plugin \<= 1.1 - SQL Injection vulnerability (CVSS 8.5, reza19 Download-Mirror-Counter)
- [CVE-2024-51625](https://cve.now/CVE-2024-51625.md): WordPress Quran Shortcode plugin \<= 1.5 - SQL Injection vulnerability (CVSS 8.5, edckwt Quran Shortcode)
- [CVE-2024-51782](https://cve.now/CVE-2024-51782.md): WordPress Loginplus plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sanjay Prasad Loginplus)
- [CVE-2024-51783](https://cve.now/CVE-2024-51783.md): WordPress Forms: 3rd-Party Post Again plugin \<= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zaus Forms: 3rd-Party Post Again)
- [CVE-2024-51784](https://cve.now/CVE-2024-51784.md): WordPress FriendStore for WooCommerce plugin \<= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, VietFriend team FriendStore for WooCommerce)
- [CVE-2024-51786](https://cve.now/CVE-2024-51786.md): WordPress Realty by BestWebSoft plugin \<= 1.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bestweblayout Realty by BestWebSoft)
- [CVE-2024-51787](https://cve.now/CVE-2024-51787.md): WordPress ElementsReady Addons for Elementor plugin \<= 6.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-51785](https://cve.now/CVE-2024-51785.md): WordPress Responsive Filterable Portfolio plugin \<= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Nks Responsive Filterable Portfolio)
- [CVE-2024-10508](https://cve.now/CVE-2024-10508.md): RegistrationMagic – User Registration Plugin with Custom Registration Forms \<= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery (CVSS 9.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2024-10589](https://cve.now/CVE-2024-10589.md): Leopard \<= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 9.8, nouthemes Leopard - WordPress Offload Media)
- [CVE-2024-10801](https://cve.now/CVE-2024-10801.md): WordPress User Extra Fields \<= 16.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, vanquish WordPress User Extra Fields)
- [CVE-2024-10547](https://cve.now/CVE-2024-10547.md): WP Membership \<= 1.6.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, e-plugins WP Membership)
- [CVE-2024-10871](https://cve.now/CVE-2024-10871.md): Category Ajax Filter \<= 2.8.2 - Unauthenticated Local File Inclusion (CVSS 9.8, trustyplugins Category AJAX Filter – Advanced Filter for Po…)
- [CVE-2024-10688](https://cve.now/CVE-2024-10688.md): Attesa Extra \<= 1.4.2 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, crestaproject Attesa Extra)
- [CVE-2024-10876](https://cve.now/CVE-2024-10876.md): Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More \<= 1.8.3 - Reflected Cross-Site Scripting (CVSS 6.1, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2024-9874](https://cve.now/CVE-2024-9874.md): WordPress Poll Maker Plugin \<= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection (CVSS 4.9, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2024-10683](https://cve.now/CVE-2024-10683.md): Contact Form 7 - PayPal & Stripe Add-on \<= 2.3.1 - Reflected Cross-Site Scripting (CVSS 6.1, scottpaterson Contact Form 7 – PayPal & Stripe Add-on)
- [CVE-2024-8756](https://cve.now/CVE-2024-8756.md): Quform - WordPress Form Builder \<= 2.20.0 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, ThemeCatcher Quform - WordPress Form Builder)
- [CVE-2024-10470](https://cve.now/CVE-2024-10470.md): WPLMS Learning Management System for WordPress \<= 4.962 - Unauthenticated Arbitrary File Read and Deletion (CVSS 9.8, VibeThemes WPLMS Learning Management System for WordPress,…)
- [CVE-2024-10667](https://cve.now/CVE-2024-10667.md): Content Slider Block – Create fully functional slider with Gutenberg block \<= 3.1.5 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, bplugins Content Slider Block – Slide Through Text or Media…)
- [CVE-2024-10669](https://cve.now/CVE-2024-10669.md): Countdown Timer block – Display the event's date into a timer. \<= 1.2.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, bplugins Countdown Timer Block – Animated Countdown for Eve…)
- [CVE-2024-10814](https://cve.now/CVE-2024-10814.md): Code Embed \<= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 6.4, dartiss Code Embed)
- [CVE-2024-10770](https://cve.now/CVE-2024-10770.md): Envo Extra \<= 1.9.3 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, envothemes Envo Extra)
- [CVE-2024-10693](https://cve.now/CVE-2024-10693.md): SKT Addons for Elementor \<= 3.3 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, sonalsinha21 SKT Addons for Elementor)
- [CVE-2024-10627](https://cve.now/CVE-2024-10627.md): WooCommerce Support Ticket System \<= 17.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, vanquish WooCommerce Support Ticket System)
- [CVE-2024-10626](https://cve.now/CVE-2024-10626.md): WooCommerce Support Ticket System \<= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, vanquish WooCommerce Support Ticket System)
- [CVE-2024-10625](https://cve.now/CVE-2024-10625.md): WooCommerce Support Ticket System \<= 17.7 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, vanquish WooCommerce Support Ticket System)
- [CVE-2024-10674](https://cve.now/CVE-2024-10674.md): Th Shop Mania \<= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8, themehunk Th Shop Mania)
- [CVE-2024-9226](https://cve.now/CVE-2024-9226.md): Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages \<= 1.7.6 - Reflected Cross-Site Scripting (CVSS 6.1, fatcatapps Landing Page Cat – Coming Soon & Maintenance Pag…)
- [CVE-2024-10673](https://cve.now/CVE-2024-10673.md): Top Store \<= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (CVSS 8.8, themehunk Top Store)
- [CVE-2024-8960](https://cve.now/CVE-2024-8960.md): Cowidgets – Elementor Addons \<= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, codelessthemes Cowidgets – Elementor Addons)
- [CVE-2024-10779](https://cve.now/CVE-2024-10779.md): Cowidgets – Elementor Addons \<= 1.2.0 - Authenticated (Contributor+) Post Disclosure (CVSS 5.3, codelessthemes Cowidgets – Elementor Addons)
- [CVE-2024-10294](https://cve.now/CVE-2024-10294.md): CE21 Suite \<= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change (CVSS 6.5, ce21com CE21 Suite)
- [CVE-2024-9775](https://cve.now/CVE-2024-9775.md): Anih - Creative Agency WordPress Theme \<= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, shtheme Anih - Creative Agency WordPress Theme)
- [CVE-2024-10285](https://cve.now/CVE-2024-10285.md): CE21 Suite \<= 2.2.0 - JWT Token Disclosure (CVSS 9.8, ce21com CE21 Suite)
- [CVE-2024-10586](https://cve.now/CVE-2024-10586.md): Debug Tool \<= 2.2 - Unauthenticated Arbitrary File Creation (CVSS 9.8, eugenbobrowski Debug Tool)
- [CVE-2024-10284](https://cve.now/CVE-2024-10284.md): CE21 Suite \<= 2.2.0 - Authentication Bypass (CVSS 9.8, ce21com CE21 Suite)
- [CVE-2024-10588](https://cve.now/CVE-2024-10588.md): Debug Tool \<= 2.2 - Missing Authorization to Information Exposure (CVSS 4.3, eugenbobrowski Debug Tool)
- [CVE-2024-9262](https://cve.now/CVE-2024-9262.md): User Meta – User Profile Builder and User management plugin \<= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 6.5, khaledsaikat User Meta – User Profile Builder and User mana…)
- [CVE-2024-9270](https://cve.now/CVE-2024-9270.md): Lenxel Core for Lenxel(LNX) LMS \<= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, ogunlab Lenxel AI LMS – Course Lesson Generator)
- [CVE-2024-52314](https://cve.now/CVE-2024-52314.md): data.all admin user may access potentially sensitive data stored by producers via logs (CVSS 6.9, amazon data.all)
- [CVE-2024-52312](https://cve.now/CVE-2024-52312.md): data.all authenticated users can perform restricted operations against DataSets and Environments (CVSS 5.3, amazon data.all)
- [CVE-2024-52313](https://cve.now/CVE-2024-52313.md): data.all authenticated users can obtain incorrect object level authorizations (CVSS 5.3, amazon data.all)
- [CVE-2024-10953](https://cve.now/CVE-2024-10953.md): data.all authenticated users can perform mutating update operations on persisted notification records (CVSS 5.3, amazon data.all)
- [CVE-2024-52311](https://cve.now/CVE-2024-52311.md): data.all does not invalidate authentication token upon user logout (CVSS 5.3, amazon data.all)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.