# CVEs published 2024-11-16

50 CVEs were published on November 16, 2024: 18 critical, 8 high. Days are UTC.

- [CVE-2024-52397](https://cve.now/CVE-2024-52397.md): WordPress Convert Docx2post plugin \<= 1.4 - Arbitrary File Upload vulnerability (CVSS 9.1, Davor Zeljkovic Convert Docx2post)
- [CVE-2024-52398](https://cve.now/CVE-2024-52398.md): WordPress CDI plugin \<= 5.5.3 - Arbitrary File Upload vulnerability (CVSS 9.1, Halyra CDI)
- [CVE-2024-52399](https://cve.now/CVE-2024-52399.md): WordPress Writer Helper plugin \<= 3.1.6 - Arbitrary File Upload vulnerability (CVSS 9.9, Clarisse K. Writer Helper)
- [CVE-2024-52400](https://cve.now/CVE-2024-52400.md): WordPress Gallerio plugin \<= 1.01 - Arbitrary File Upload vulnerability (CVSS 9.9, Subhasis Laha Gallerio)
- [CVE-2024-52403](https://cve.now/CVE-2024-52403.md): WordPress User Management plugin \<= 1.1 - Arbitrary File Upload vulnerability (CVSS 9.9, Saad Iqbal User Management)
- [CVE-2024-52404](https://cve.now/CVE-2024-52404.md): WordPress CF7 Reply Manager plugin \<= 1.2.3 - Arbitrary File Upload vulnerability (CVSS 9.9, bigfiveagency CF7 Reply Manager)
- [CVE-2024-52405](https://cve.now/CVE-2024-52405.md): WordPress B-Banner Slider plugin \<= 1.1 - Arbitrary File Upload vulnerability (CVSS 9.9, bikramjoshii B-Banner Slider)
- [CVE-2024-52406](https://cve.now/CVE-2024-52406.md): WordPress CSV to html plugin \<= 3.26 - Arbitrary File Upload vulnerability (CVSS 9.9, wibergsweb CSV to html)
- [CVE-2024-52407](https://cve.now/CVE-2024-52407.md): WordPress BasePress Migration Tools plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 9.9, BasePress Migration Tools)
- [CVE-2024-52408](https://cve.now/CVE-2024-52408.md): WordPress Push Notifications for WordPress by PushAssist plugin \<= 3.0.8 - Arbitrary File Upload vulnerability (CVSS 9.9, Push Notifications for WordPress by PushAssist)
- [CVE-2024-52409](https://cve.now/CVE-2024-52409.md): WordPress AJAX Random Posts plugin \<= 0.3.3 - PHP Object Injection vulnerability (CVSS 9.8, Phoenixheart AJAX Random Posts)
- [CVE-2024-52410](https://cve.now/CVE-2024-52410.md): WordPress Referrer Detector plugin \<= 4.2.1.0 - PHP Object Injection vulnerability (CVSS 9.8, Phoenixheart Referrer Detector)
- [CVE-2024-52411](https://cve.now/CVE-2024-52411.md): WordPress Advanced Personalization plugin \<= 1.1.2 - PHP Object Injection vulnerability (CVSS 9.8, flowcraft Advanced Personalization)
- [CVE-2024-52412](https://cve.now/CVE-2024-52412.md): WordPress Xin theme \<= 1.0.8.1 - PHP Object Injection vulnerability (CVSS 9.8, Stephen Cui Xin)
- [CVE-2024-52413](https://cve.now/CVE-2024-52413.md): WordPress Airin Blog theme \<= 1.6.1 - PHP Object Injection vulnerability (CVSS 9.8, dmcwebzone Airin Blog)
- [CVE-2024-52414](https://cve.now/CVE-2024-52414.md): WordPress WDES Responsive Mobile Menu plugin \<= 5.3.18 - PHP Object Injection vulnerability (CVSS 9.8, Anthony Carbon WDES Responsive Mobile Menu)
- [CVE-2024-52386](https://cve.now/CVE-2024-52386.md): WordPress Classified Listing plugin \<= 3.1.16 - Local File Inclusion vulnerability (CVSS 5.3, RadiusTheme Classified Listing)
- [CVE-2024-52415](https://cve.now/CVE-2024-52415.md): WordPress SK WP Settings Backup plugin \<= 1.0 - CSRF to PHP Object Injection vulnerability (CVSS 8.8, skipstorm SK WP Settings Backup)
- [CVE-2024-52416](https://cve.now/CVE-2024-52416.md): WordPress Debug Tool plugin \<= 2.2 - Remote Code Execution vulnerability (CVSS 10.0, Eugen Bobrowski Debug Tool)
- [CVE-2024-11094](https://cve.now/CVE-2024-11094.md): 404 Solution \<= 2.35.17 - Missing Authentication to Sensitive Information Exposure (CVSS 5.3, aaron13100 404 Solution)
- [CVE-2024-10592](https://cve.now/CVE-2024-10592.md): Mapster WP Maps \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Mapster WP Maps)
- [CVE-2024-9887](https://cve.now/CVE-2024-9887.md): Login using WordPress Users ( WP as SAML IDP ) \<= 1.15.6 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, cyberlord92 SAML IDP (Identity Provider) – Login with Websi…)
- [CVE-2024-10645](https://cve.now/CVE-2024-10645.md): Blogger 301 Redirect \<= 2.5.3 - Unauthenticated SQL Injection via br (CVSS 7.5, sudiptomahato Blogger 301 Redirect)
- [CVE-2024-10614](https://cve.now/CVE-2024-10614.md): Customer Reviews for WooCommerce \<= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation (CVSS 4.3, ivole Customer Reviews for WooCommerce)
- [CVE-2024-8856](https://cve.now/CVE-2024-8856.md): Backup and Staging by WP Time Capsule \<= 1.22.21 - Unauthenticated Arbitrary File Upload (CVSS 9.8, revmakx Backup and Staging by WP Time Capsule)
- [CVE-2024-10728](https://cve.now/CVE-2024-10728.md): PostX \<= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation (CVSS 8.8, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2024-10533](https://cve.now/CVE-2024-10533.md): WP Chat App \<= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation (CVSS 4.3, ninjateam WP Chat App)
- [CVE-2024-10262](https://cve.now/CVE-2024-10262.md): Drop Shadow Boxes \<= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3, stevehenty Drop Shadow Boxes)
- [CVE-2024-9839](https://cve.now/CVE-2024-9839.md): Uix Slideshow \<= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, uiuxlab Uix Slideshow)
- [CVE-2024-11085](https://cve.now/CVE-2024-11085.md): WP Log Viewer \<= 1.2.1 - Missing Authorization (CVSS 5.4, maxwellberkel WP Log Viewer)
- [CVE-2024-8873](https://cve.now/CVE-2024-8873.md): PeproDev WooCommerce Receipt Uploader \<= 2.6.9 - Reflected Cross-Site Scripting (CVSS 6.1, PeproDev WooCommerce Receipt Uploader)
- [CVE-2024-9850](https://cve.now/CVE-2024-9850.md): SVG Case Study \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, augustinfotech SVG Case Study)
- [CVE-2024-9938](https://cve.now/CVE-2024-9938.md): Bounce Handler MailPoet 3 \<= 1.3.21 - Reflected Cross-Site Scripting (CVSS 6.1, kasperta Bounce Handler MailPoet)
- [CVE-2024-6628](https://cve.now/CVE-2024-6628.md): EleForms – All In One Form Integration including DB for Elementor \<= 2.9.9.9 - Cross-Site Request Forgery (CVSS 4.3, cscode EleForms – All In One Form Integration including DB…)
- [CVE-2024-10015](https://cve.now/CVE-2024-10015.md): ConvertCalculator for WordPress \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter (CVSS 6.4, jorisderuiter ConvertCalculator: Build Cost, Price, Quotati…)
- [CVE-2024-9615](https://cve.now/CVE-2024-9615.md): BulkPress \<= 0.3.5 - Reflected Cross-Site Scripting (CVSS 6.1, engelen BulkPress)
- [CVE-2024-10147](https://cve.now/CVE-2024-10147.md): Steel \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode (CVSS 6.4, starverte Steel)
- [CVE-2024-9386](https://cve.now/CVE-2024-9386.md): Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme \<= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpmariocom Exclusive Divi – Divi Preloader, Modules for Div…)
- [CVE-2024-11092](https://cve.now/CVE-2024-11092.md): SVGPlus \<= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, petrichorpost SVGPlus)
- [CVE-2024-10875](https://cve.now/CVE-2024-10875.md): Gallery Manager \<= 1.6.58 - Reflected Cross-Site Scripting (CVSS 6.1, dhoppe Gallery Manager)
- [CVE-2024-11118](https://cve.now/CVE-2024-11118.md): 404 Error Monitor \<= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function (CVSS 5.3, bilbud 404 Error Monitor)
- [CVE-2024-9935](https://cve.now/CVE-2024-9935.md): PDF Generator Addon for Elementor Page Builder \<= 2.0.0 - Unauthenticated Arbitrary File Download (CVSS 7.5, redefiningtheweb PDF Generator for WordPress Elementor)
- [CVE-2024-9192](https://cve.now/CVE-2024-9192.md): WP Video Robot \<= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update (CVSS 8.8, pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2024-10017](https://cve.now/CVE-2024-10017.md): PJW Mime Config \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, westi PJW Mime Config)
- [CVE-2024-9849](https://cve.now/CVE-2024-9849.md): Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder \<= 4.8 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, creativeinteractivemedia Real 3D Flipbook – 3D FlipBook, PD…)
- [CVE-2024-10884](https://cve.now/CVE-2024-10884.md): SimpleForm Contact Form Submissions \<= 2.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, SimpleForm Contact Form Submissions)
- [CVE-2024-10883](https://cve.now/CVE-2024-10883.md): SimpleForm – Contact form made simple \<= 2.2.0 - Reflected Cross-Site Scripting (CVSS 6.1, SimpleForm – Contact form made simple)
- [CVE-2024-10786](https://cve.now/CVE-2024-10786.md): Simple Local Avatars \<= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing (CVSS 4.3, 10up Simple Local Avatars)
- [CVE-2024-10861](https://cve.now/CVE-2024-10861.md): Popup Box – Create Countdown, Coupon, Video, Contact Form Popups \<= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update (CVSS 5.3, ays-pro Popup Box – Create Countdown, Coupon, Video, Contac…)
- [CVE-2024-10795](https://cve.now/CVE-2024-10795.md): Popularis Extra \<= 1.2.7 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, themes4wp Popularis Extra)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.