CVEs published November 16, 2024
50 CVEs were published on November 16, 2024: 18 critical, 8 high.
- Published
- 50
- Critical
- 18
- High
- 8
- Medium
- 24
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- 10up Simple Local Avatars
- 1
- aaron13100 404 Solution
- 1
- Anthony Carbon WDES Responsive Mobile Menu
- 1
- augustinfotech SVG Case Study
- 1
- ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- 1
- BasePress Migration Tools
- 1
- bigfiveagency CF7 Reply Manager
- 1
- bikramjoshii B-Banner Slider
- 1
- bilbud 404 Error Monitor
- 1
- Clarisse K. Writer Helper
- 1
Critical 18
- CVE-2024-52397WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerabilityDavor Zeljkovic Convert Docx2post
- CVE-2024-52398WordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerabilityHalyra CDI
- CVE-2024-52399WordPress Writer Helper plugin <= 3.1.6 - Arbitrary File Upload vulnerabilityClarisse K. Writer Helper
- CVE-2024-52400WordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerabilitySubhasis Laha Gallerio
- CVE-2024-52403WordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerabilitySaad Iqbal User Management
- CVE-2024-52404WordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerabilitybigfiveagency CF7 Reply Manager
- CVE-2024-52405WordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerabilitybikramjoshii B-Banner Slider
- CVE-2024-52406WordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerabilitywibergsweb CSV to html
- CVE-2024-52407WordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityBasePress Migration Tools
- CVE-2024-52408WordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerabilityPush Notifications for WordPress by PushAssist
- CVE-2024-52409WordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerabilityPhoenixheart AJAX Random Posts
- CVE-2024-52410WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerabilityPhoenixheart Referrer Detector
- CVE-2024-52411WordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerabilityflowcraft Advanced Personalization
- CVE-2024-52412WordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerabilityStephen Cui Xin
- CVE-2024-52413WordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerabilitydmcwebzone Airin Blog
- CVE-2024-52414WordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerabilityAnthony Carbon WDES Responsive Mobile Menu
- CVE-2024-52416WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerabilityEugen Bobrowski Debug Tool
- CVE-2024-8856Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx Backup and Staging by WP Time Capsule
High 8
- CVE-2024-52415WordPress SK WP Settings Backup plugin <= 1.0 - CSRF to PHP Object Injection vulnerabilityskipstorm SK WP Settings Backup
- CVE-2024-9887Login using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injectioncyberlord92 SAML IDP (Identity Provider) – Login with Websi…
- CVE-2024-10645Blogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via brsudiptomahato Blogger 301 Redirect
- CVE-2024-10728PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activationwpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2024-9839Uix Slideshow <= 1.6.5 - Unauthenticated Arbitrary Shortcode Executionuiuxlab Uix Slideshow
- CVE-2024-9935PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Downloadredefiningtheweb PDF Generator for WordPress Elementor
- CVE-2024-9192WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Updatepressaholic WordPress Video Robot - The Ultimate Video Impo…
- CVE-2024-9849Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Uploadcreativeinteractivemedia Real 3D Flipbook – 3D FlipBook, PD…
Medium, low and unrated 24
- CVE-2024-52386WordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerabilityRadiusTheme Classified Listing
- CVE-2024-11094404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposureaaron13100 404 Solution
- CVE-2024-10592Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingMapster WP Maps
- CVE-2024-10614Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellationivole Customer Reviews for WooCommerce
- CVE-2024-10533WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installationninjateam WP Chat App
- CVE-2024-10262Drop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Executionstevehenty Drop Shadow Boxes
- CVE-2024-11085WP Log Viewer <= 1.2.1 - Missing Authorizationmaxwellberkel WP Log Viewer
- CVE-2024-8873PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site ScriptingPeproDev WooCommerce Receipt Uploader
- CVE-2024-9850SVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadaugustinfotech SVG Case Study
- CVE-2024-9938Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scriptingkasperta Bounce Handler MailPoet
- CVE-2024-6628EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgerycscode EleForms – All In One Form Integration including DB…
- CVE-2024-10015ConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameterjorisderuiter ConvertCalculator: Build Cost, Price, Quotati…
- CVE-2024-9615BulkPress <= 0.3.5 - Reflected Cross-Site Scriptingengelen BulkPress
- CVE-2024-10147Steel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcodestarverte Steel
- CVE-2024-9386Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpmariocom Exclusive Divi – Divi Preloader, Modules for Div…
- CVE-2024-11092SVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadpetrichorpost SVGPlus
- CVE-2024-10875Gallery Manager <= 1.6.58 - Reflected Cross-Site Scriptingdhoppe Gallery Manager
- CVE-2024-11118404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Functionbilbud 404 Error Monitor
- CVE-2024-10017PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwesti PJW Mime Config
- CVE-2024-10884SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site ScriptingSimpleForm Contact Form Submissions
- CVE-2024-10883SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site ScriptingSimpleForm – Contact form made simple
- CVE-2024-10786Simple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing10up Simple Local Avatars
- CVE-2024-10861Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Updateays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- CVE-2024-10795Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosurethemes4wp Popularis Extra