# CVEs published 2024-11-19

388 CVEs were published on November 19, 2024: 17 critical, 114 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2018-9467](https://cve.now/CVE-2018-9467.md): In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. (CVSS 9.8, Google Android)
- [CVE-2024-44309](https://cve.now/CVE-2024-44309.md): A cookie management issue was addressed with improved state management. (CVSS 6.3, KEV, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-44308](https://cve.now/CVE-2024-44308.md): The issue was addressed with improved checks. (CVSS 8.8, KEV, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-44307](https://cve.now/CVE-2024-44307.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2024-44306](https://cve.now/CVE-2024-44306.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2018-9466](https://cve.now/CVE-2018-9466.md): In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. (CVSS 8.8, Google Android)
- [CVE-2018-9456](https://cve.now/CVE-2018-9456.md): In sdpu\_extract\_attr\_seq of sdp\_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 7.5, Google Android)
- [CVE-2018-9440](https://cve.now/CVE-2018-9440.md): In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. (CVSS 6.5, Google Android)
- [CVE-2024-51669](https://cve.now/CVE-2024-51669.md): WordPress Dynamic Widgets plugin \<= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Kalmang Dynamic Widgets)
- [CVE-2024-52392](https://cve.now/CVE-2024-52392.md): WordPress W3SPEEDSTER plugin \<= 7.25 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.3, W3SPEEDSTER)
- [CVE-2024-30424](https://cve.now/CVE-2024-30424.md): WordPress Beaver Builder Addons by WPZOOM plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Beaver Builder Addons by WPZOOM)
- [CVE-2023-27609](https://cve.now/CVE-2023-27609.md): WordPress WP Roles at Registration plugin \<= 0.23 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, NetTantra WP Roles at Registration)
- [CVE-2024-11400](https://cve.now/CVE-2024-11400.md): HUSKY – Products Filter for WooCommerce \<= 1.3.6.3 - Reflected Cross-Site Scripting via really\_curr\_tax Parameter (CVSS 6.1, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2018-9433](https://cve.now/CVE-2018-9433.md): In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. (CVSS 9.8, Google Android)
- [CVE-2024-52595](https://cve.now/CVE-2024-52595.md): HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through (CVSS 7.7, fedora-python lxml\_html\_clean · lxml-html-clean)
- [CVE-2018-9432](https://cve.now/CVE-2018-9432.md): In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissions bypass. (CVSS 7.8, Google Android)
- [CVE-2018-9428](https://cve.now/CVE-2018-9428.md): In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free. (CVSS 8.4, Google Android)
- [CVE-2018-9424](https://cve.now/CVE-2018-9424.md): In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2018-9421](https://cve.now/CVE-2018-9421.md): In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2018-9420](https://cve.now/CVE-2018-9420.md): In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2018-9419](https://cve.now/CVE-2018-9419.md): In l2cble\_process\_sig\_cmd of l2c\_ble.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2018-9417](https://cve.now/CVE-2018-9417.md): In f\_hidg\_read and hidg\_disable of f\_hid.c, there is a possible use-after-free due to improper locking. (CVSS 7.8, Google Android)
- [CVE-2018-9412](https://cve.now/CVE-2018-9412.md): In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2018-9411](https://cve.now/CVE-2018-9411.md): In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2018-9410](https://cve.now/CVE-2018-9410.md): In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2018-9365](https://cve.now/CVE-2018-9365.md): In smp\_data\_received of smp\_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing bounds check. (CVSS 9.8, Google Andrioid)
- [CVE-2024-45422](https://cve.now/CVE-2024-45422.md): Zoom Apps - Improper Input Validation (CVSS 6.5, Zoom Communications Zoom Workplace Apps, SDKs, Rooms Client…)
- [CVE-2024-52359](https://cve.now/CVE-2024-52359.md): IBM Concert Software improper access controls (CVSS 4.3, IBM Concert Software)
- [CVE-2024-45420](https://cve.now/CVE-2024-45420.md): Zoom Apps - Uncontrolled Resource Consumption (CVSS 4.3, Zoom Communications Zoom Workplace Apps, SDKs, Rooms Client…)
- [CVE-2024-52360](https://cve.now/CVE-2024-52360.md): IBM Concert Software SQL injection (CVSS 7.6, IBM Concert Software)
- [CVE-2024-45419](https://cve.now/CVE-2024-45419.md): Zoom Apps - Improper Input Validation (CVSS 8.1, Zoom Communications Zoom Workplace Apps, SDKs, Rooms Client…)
- [CVE-2018-9409](https://cve.now/CVE-2018-9409.md): In HWCSession::SetColorModeById of hwc\_session.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-37070](https://cve.now/CVE-2024-37070.md): IBM Concert Software information disclosure (CVSS 4.3, IBM Concert Software)
- [CVE-2018-9372](https://cve.now/CVE-2018-9372.md): In cmd\_flash\_mmc\_sparse\_img of dl\_commands.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2018-9371](https://cve.now/CVE-2018-9371.md): In the Mediatek Preloader, there are out of bounds reads and writes due to an exposed interface that allows arbitrary peripheral memory mapp (CVSS 7.8, Google Android)
- [CVE-2018-9370](https://cve.now/CVE-2018-9370.md): In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing boun (CVSS 7.8, Google Android)
- [CVE-2018-9369](https://cve.now/CVE-2018-9369.md): In bootloader there is fastboot command allowing user specified kernel command line arguments. (CVSS 7.8, Google Android)
- [CVE-2018-9368](https://cve.now/CVE-2018-9368.md): In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. (CVSS 6.7, Google Android)
- [CVE-2018-9367](https://cve.now/CVE-2018-9367.md): In FT\_ACDK\_CCT\_V2\_OP\_ISP\_SET\_TUNING\_PARAS of Meta\_CCAP\_Para.cpp, there is a possible out of bounds write due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2018-9366](https://cve.now/CVE-2018-9366.md): In IMSA\_Recv\_Thread and VT\_IMCB\_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer ove (CVSS 7.8, Google Android)
- [CVE-2024-11395](https://cve.now/CVE-2024-11395.md): Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2018-9364](https://cve.now/CVE-2018-9364.md): In the LG LAF component, there is a special command that allowed modification of certain partitions. (CVSS 7.5, Google Android)
- [CVE-2018-9348](https://cve.now/CVE-2018-9348.md): In SMF\_ParseMetaEvent of eas\_smf.c, there is a possible integer overflow. (CVSS 7.5, Google Android)
- [CVE-2018-9346](https://cve.now/CVE-2018-9346.md): In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2018-9345](https://cve.now/CVE-2018-9345.md): In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. (CVSS 5.5, Google Android)
- [CVE-2024-51503](https://cve.now/CVE-2024-51503.md): A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate p (CVSS 8.0, Trend Micro Deep Security)
- [CVE-2024-21697](https://cve.now/CVE-2024-21697.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and 3.4.19 for Sourcetre (CVSS 8.8, Atlassian Sourcetree for Mac · Atlassian Sourcetree for Win…)
- [CVE-2018-9344](https://cve.now/CVE-2018-9344.md): In several functions of DescramblerImpl.cpp, there is a possible use after free due to improper locking. (CVSS 7.8, Google Android)
- [CVE-2018-9341](https://cve.now/CVE-2018-9341.md): In impeg2d\_mc\_fullx\_fully of impeg2d\_mc.c there is a possible out of bound write due to missing bounds check. (CVSS 9.8, Google Android)
- [CVE-2018-9340](https://cve.now/CVE-2018-9340.md): In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, cau (CVSS 7.5, Google Android)
- [CVE-2018-9339](https://cve.now/CVE-2018-9339.md): In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. (CVSS 7.8, Google Android)
- [CVE-2024-50430](https://cve.now/CVE-2024-50430.md): WordPress Beaver Builder plugin \<= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Beaver Builder)
- [CVE-2018-9338](https://cve.now/CVE-2018-9338.md): In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2023-21270](https://cve.now/CVE-2023-21270.md): In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoke (CVSS 7.8, Google Andrioid)
- [CVE-2017-13315](https://cve.now/CVE-2017-13315.md): In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. (CVSS 7.8, Google Android)
- [CVE-2024-53088](https://cve.now/CVE-2024-53088.md): i40e: fix race condition by adding filter's intermediate sync state (CVSS 7.8, Linux)
- [CVE-2024-53087](https://cve.now/CVE-2024-53087.md): drm/xe: Fix possible exec queue leak in exec IOCTL (CVSS 5.5, Linux)
- [CVE-2024-53086](https://cve.now/CVE-2024-53086.md): drm/xe: Drop VM dma-resv lock on xe\_sync\_in\_fence\_get failure in exec IOCTL (CVSS 5.5, Linux)
- [CVE-2024-53085](https://cve.now/CVE-2024-53085.md): tpm: Lock TPM chip in tpm\_pm\_suspend() first (no CVSS, Linux)
- [CVE-2024-53084](https://cve.now/CVE-2024-53084.md): drm/imagination: Break an object reference loop (CVSS 5.5, Linux)
- [CVE-2024-53083](https://cve.now/CVE-2024-53083.md): usb: typec: qcom-pmic: init value of hdr\_len/txbuf\_len earlier (CVSS 5.5, Linux)
- [CVE-2024-53082](https://cve.now/CVE-2024-53082.md): virtio\_net: Add hash\_key\_length check (CVSS 8.4, Linux)
- [CVE-2024-53081](https://cve.now/CVE-2024-53081.md): media: ar0521: don't overflow when checking PLL values (CVSS 5.5, Linux)
- [CVE-2024-53080](https://cve.now/CVE-2024-53080.md): drm/panthor: Lock XArray when getting entries for the VM (CVSS 7.8, Linux)
- [CVE-2024-53079](https://cve.now/CVE-2024-53079.md): mm/thp: fix deferred split unqueue naming and locking (CVSS 7.8, Linux)
- [CVE-2024-48992](https://cve.now/CVE-2024-48992.md): Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int (CVSS 7.8, needrestart)
- [CVE-2024-48991](https://cve.now/CVE-2024-48991.md): Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race condition (CVSS 7.8, needrestart)
- [CVE-2024-48990](https://cve.now/CVE-2024-48990.md): Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int (CVSS 7.8, needrestart)
- [CVE-2024-11003](https://cve.now/CVE-2024-11003.md): Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input. (CVSS 7.8, needrestart)
- [CVE-2024-10224](https://cve.now/CVE-2024-10224.md): Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly (CVSS 5.3, Module::ScanDeps)
- [CVE-2024-53078](https://cve.now/CVE-2024-53078.md): drm/tegra: Fix NULL vs IS\_ERR() check in probe() (CVSS 5.5, Linux)
- [CVE-2024-53077](https://cve.now/CVE-2024-53077.md): rpcrdma: Always release the rpcrdma\_device's xa\_array (CVSS 5.5, Linux)
- [CVE-2024-53076](https://cve.now/CVE-2024-53076.md): iio: gts-helper: Fix memory leaks for the error path of iio\_gts\_build\_avail\_scale\_table() (CVSS 7.8, Linux)
- [CVE-2024-53075](https://cve.now/CVE-2024-53075.md): riscv: Prevent a bad reference count on CPU nodes (no CVSS, Linux)
- [CVE-2024-53074](https://cve.now/CVE-2024-53074.md): wifi: iwlwifi: mvm: don't leak a link on AP removal (CVSS 5.5, Linux)
- [CVE-2024-53073](https://cve.now/CVE-2024-53073.md): NFSD: Never decrement pending\_async\_copies on error (CVSS 7.5, Linux)
- [CVE-2024-53072](https://cve.now/CVE-2024-53072.md): platform/x86/amd/pmc: Detect when STB is not available (CVSS 5.5, Linux)
- [CVE-2024-53071](https://cve.now/CVE-2024-53071.md): drm/panthor: Be stricter about IO mapping flags (CVSS 5.5, Linux)
- [CVE-2024-53070](https://cve.now/CVE-2024-53070.md): usb: dwc3: fix fault at system suspend if device was already runtime suspended (CVSS 5.5, Linux)
- [CVE-2024-53069](https://cve.now/CVE-2024-53069.md): firmware: qcom: scm: fix a NULL-pointer dereference (CVSS 5.5, Linux)
- [CVE-2024-53068](https://cve.now/CVE-2024-53068.md): firmware: arm\_scmi: Fix slab-use-after-free in scmi\_bus\_notifier() (CVSS 7.8, Linux)
- [CVE-2024-53067](https://cve.now/CVE-2024-53067.md): scsi: ufs: core: Start the RTC update work later (no CVSS, Linux)
- [CVE-2024-53066](https://cve.now/CVE-2024-53066.md): nfs: Fix KMSAN warning in decode\_getfattr\_attrs() (CVSS 9.8, Linux)
- [CVE-2024-53065](https://cve.now/CVE-2024-53065.md): mm/slab: fix warning caused by duplicate kmem\_cache creation in kmem\_buckets\_create (CVSS 5.5, Linux)
- [CVE-2024-53064](https://cve.now/CVE-2024-53064.md): idpf: fix idpf\_vc\_core\_init error path (CVSS 5.5, Linux)
- [CVE-2024-53063](https://cve.now/CVE-2024-53063.md): media: dvbdev: prevent the risk of out of memory access (CVSS 7.8, Linux)
- [CVE-2024-53062](https://cve.now/CVE-2024-53062.md): media: mgb4: protect driver against spectre (CVSS 7.1, Linux)
- [CVE-2024-53061](https://cve.now/CVE-2024-53061.md): media: s5p-jpeg: prevent buffer overflows (CVSS 7.3, Linux)
- [CVE-2024-53060](https://cve.now/CVE-2024-53060.md): drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (CVSS 5.5, Linux)
- [CVE-2024-42450](https://cve.now/CVE-2024-42450.md): The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. (CVSS 10.0, Versa Director)
- [CVE-2022-47424](https://cve.now/CVE-2022-47424.md): WordPress ARMember plugin \<= 4.0.5 - Cross Site Request Forgery (CSRF) (CVSS 5.4, Repute InfoSystems ARMember)
- [CVE-2024-53059](https://cve.now/CVE-2024-53059.md): wifi: iwlwifi: mvm: Fix response handling in iwl\_mvm\_send\_recovery\_cmd() (CVSS 7.1, Linux)
- [CVE-2024-53058](https://cve.now/CVE-2024-53058.md): net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data (CVSS 9.4, Linux)
- [CVE-2024-53057](https://cve.now/CVE-2024-53057.md): net/sched: stop qdisc\_tree\_reduce\_backlog on TC\_H\_ROOT (CVSS 7.8, Linux)
- [CVE-2024-53056](https://cve.now/CVE-2024-53056.md): drm/mediatek: Fix potential NULL dereference in mtk\_crtc\_destroy() (CVSS 5.5, Linux)
- [CVE-2024-53055](https://cve.now/CVE-2024-53055.md): wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVSS 5.5, Linux)
- [CVE-2024-53053](https://cve.now/CVE-2024-53053.md): scsi: ufs: core: Fix another deadlock during RTC update (no CVSS, Linux)
- [CVE-2024-53052](https://cve.now/CVE-2024-53052.md): io\_uring/rw: fix missing NOWAIT check for O\_DIRECT start write (CVSS 4.4, Linux)
- [CVE-2024-53051](https://cve.now/CVE-2024-53051.md): drm/i915/hdcp: Add encoder check in intel\_hdcp\_get\_capability (CVSS 5.5, Linux)
- [CVE-2024-53050](https://cve.now/CVE-2024-53050.md): drm/i915/hdcp: Add encoder check in hdcp2\_get\_capability (CVSS 5.5, Linux)
- [CVE-2024-53049](https://cve.now/CVE-2024-53049.md): slub/kunit: fix a WARNING due to unwrapped \_\_kmalloc\_cache\_noprof (CVSS 5.5, Linux)
- [CVE-2024-53048](https://cve.now/CVE-2024-53048.md): ice: fix crash on probe for DPLL enabled E810 LOM (CVSS 5.5, Linux)
- [CVE-2024-53047](https://cve.now/CVE-2024-53047.md): mptcp: init: protect sched with rcu\_read\_lock (CVSS 5.5, Linux)
- [CVE-2024-53046](https://cve.now/CVE-2024-53046.md): arm64: dts: imx8ulp: correct the flexspi compatible string (CVSS 5.5, Linux)
- [CVE-2024-53045](https://cve.now/CVE-2024-53045.md): ASoC: dapm: fix bounds checker error in dapm\_widget\_list\_create (CVSS 5.5, Linux)
- [CVE-2024-53044](https://cve.now/CVE-2024-53044.md): net/sched: sch\_api: fix xa\_insert() error path in tcf\_block\_get\_ext() (CVSS 7.8, Linux)
- [CVE-2024-53043](https://cve.now/CVE-2024-53043.md): mctp i2c: handle NULL header address (CVSS 5.5, Linux)
- [CVE-2024-53042](https://cve.now/CVE-2024-53042.md): ipv4: ip\_tunnel: Fix suspicious RCU usage warning in ip\_tunnel\_init\_flow() (CVSS 5.5, Linux)
- [CVE-2024-50304](https://cve.now/CVE-2024-50304.md): ipv4: ip\_tunnel: Fix suspicious RCU usage warning in ip\_tunnel\_find() (no CVSS, Linux)
- [CVE-2024-50303](https://cve.now/CVE-2024-50303.md): resource,kexec: walk\_system\_ram\_res\_rev must retain resource flags (CVSS 5.5, Linux)
- [CVE-2024-43338](https://cve.now/CVE-2024-43338.md): WordPress Crowdsignal Polls & Ratings plugin \<= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Automattic Crowdsignal Dashboard – Polls, Surveys & more)
- [CVE-2024-51686](https://cve.now/CVE-2024-51686.md): WordPress Manage User Columns plugin \<= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Deepak Khokhar Manage User Columns)
- [CVE-2024-52388](https://cve.now/CVE-2024-52388.md): WordPress Hebrew Date plugin \<= 2.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, mikeage Hebrew Date)
- [CVE-2024-52401](https://cve.now/CVE-2024-52401.md): WordPress Hacklog DownloadManager plugin \<=2.1.4 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, HuangYe WuDeng Hacklog DownloadManager)
- [CVE-2024-52402](https://cve.now/CVE-2024-52402.md): WordPress Exclusive Content Password Protect plugin \<= 1.1.0 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, gunghoinc Exclusive Content Password Protect)
- [CVE-2024-52420](https://cve.now/CVE-2024-52420.md): WordPress Disable Admin Notices individually plugin \<= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Themeisle Disable Admin Notices individually)
- [CVE-2024-50532](https://cve.now/CVE-2024-50532.md): WordPress Events Manager Pro – extended plugin \<= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jerin K Alexander Events Manager Pro – extended)
- [CVE-2024-50533](https://cve.now/CVE-2024-50533.md): WordPress Domain Sharding plugin \<= 1.2.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Garcia Domain Sharding)
- [CVE-2024-50534](https://cve.now/CVE-2024-50534.md): WordPress World Prayer Time plugin \<= 2.0 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, techdabang World Prayer Time)
- [CVE-2024-51631](https://cve.now/CVE-2024-51631.md): WordPress Sticky Social Bar plugin \<= 2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Md Eftakhairul Islam Sticky Social Bar)
- [CVE-2024-51632](https://cve.now/CVE-2024-51632.md): WordPress SH Slideshow plugin \<= 4.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sam Hoe SH Slideshow)
- [CVE-2024-51633](https://cve.now/CVE-2024-51633.md): WordPress Simple Page Specific Sidebars plugin \<= 2.14.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ivycat Simple Page Specific Sidebars)
- [CVE-2024-51634](https://cve.now/CVE-2024-51634.md): WordPress Webriti Custom Login plugin \<= 0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, a.ankit Webriti Custom Login)
- [CVE-2024-51635](https://cve.now/CVE-2024-51635.md): WordPress While Loading plugin \<= 3.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Garmur While Loading)
- [CVE-2024-51636](https://cve.now/CVE-2024-51636.md): WordPress Plugin Name: GMO Social Connection plugin \<= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Z.com byGMO GMO Social Connection)
- [CVE-2024-51637](https://cve.now/CVE-2024-51637.md): WordPress Admin SMS Alert plugin \<= 1.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sroyalty Admin SMS Alert)
- [CVE-2024-51638](https://cve.now/CVE-2024-51638.md): WordPress Awesome Shortcodes For Genesis plugin 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sanjeev Mohindra Awesome Shortcodes For Genesis)
- [CVE-2024-51639](https://cve.now/CVE-2024-51639.md): WordPress Naver Blog plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Hints Naver Blog)
- [CVE-2024-51640](https://cve.now/CVE-2024-51640.md): WordPress MDR Webmaster Tools plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Matt Rude MDR Webmaster Tools)
- [CVE-2024-51641](https://cve.now/CVE-2024-51641.md): WordPress Advanced PDF Generator plugin \<= 0.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Juan Camilo Advanced PDF Generator)
- [CVE-2024-51642](https://cve.now/CVE-2024-51642.md): WordPress Seo Free plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivan9146 Seo Free)
- [CVE-2024-51643](https://cve.now/CVE-2024-51643.md): WordPress Amazon Associate Filter plugin \<= 0.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, ragaskar Amazon Associate Filter)
- [CVE-2024-51644](https://cve.now/CVE-2024-51644.md): WordPress Addressbook plugin \<= 1.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, samwilson Addressbook)
- [CVE-2024-51645](https://cve.now/CVE-2024-51645.md): WordPress ThemeFuse Maintenance Mode plugin \<= 1.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, themefusecom ThemeFuse Maintenance Mode)
- [CVE-2024-51648](https://cve.now/CVE-2024-51648.md): WordPress e-shops plugin 1.0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, hands01 e-shops)
- [CVE-2024-51649](https://cve.now/CVE-2024-51649.md): WordPress Mobilize plugin \<= 3.0.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Patrick Lumumba Mobilize)
- [CVE-2024-51650](https://cve.now/CVE-2024-51650.md): WordPress Random Featured Post plugin \<= 1.1.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, scottmydollarplancom Random Featured Post)
- [CVE-2024-51652](https://cve.now/CVE-2024-51652.md): WordPress Skip To plugin \<= 2.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, marckocher Skip To)
- [CVE-2024-51653](https://cve.now/CVE-2024-51653.md): WordPress UPDATE NOTIFICATIONS plugin \<= 0.3.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, akira1891 UPDATE NOTIFICATIONS)
- [CVE-2024-51654](https://cve.now/CVE-2024-51654.md): WordPress APK Downloader plugin \<= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Eric Allen APK Downloader)
- [CVE-2024-51655](https://cve.now/CVE-2024-51655.md): WordPress Custom Author URL plugin \<= 2.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, microkid Custom Author URL)
- [CVE-2024-51656](https://cve.now/CVE-2024-51656.md): WordPress Flash Show And Hide Box plugin \<= 1.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, litefeel Flash Show And Hide Box)
- [CVE-2024-51657](https://cve.now/CVE-2024-51657.md): WordPress SmartLink Dynamic URLs plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Woopy Plugins SmartLink Dynamic URLs)
- [CVE-2024-52421](https://cve.now/CVE-2024-52421.md): WordPress WP Popup Window Maker plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, wp-buy WP Popup Window Maker)
- [CVE-2024-50513](https://cve.now/CVE-2024-50513.md): WordPress PostX plugin \<= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPXPO PostX)
- [CVE-2024-50514](https://cve.now/CVE-2024-50514.md): WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin \<= 3.8.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kevin Stover Ninja Forms)
- [CVE-2024-50515](https://cve.now/CVE-2024-50515.md): WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin \<= 3.8.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kevin Stover Ninja Forms)
- [CVE-2024-50516](https://cve.now/CVE-2024-50516.md): WordPress Countdown & Clock plugin \<= 3.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, adamskaat Countdown & Clock)
- [CVE-2024-50517](https://cve.now/CVE-2024-50517.md): WordPress ID-SK Toolkit plugin \<= 1.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IDSK team ID-SK Toolkit)
- [CVE-2024-50518](https://cve.now/CVE-2024-50518.md): WordPress Pricer Ninja plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Common Ninja Pricer Ninja)
- [CVE-2024-50519](https://cve.now/CVE-2024-50519.md): WordPress Jigoshop – Store Exporter plugin \<= 1.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Josh Kohlbach Jigoshop – Store Exporter)
- [CVE-2024-50520](https://cve.now/CVE-2024-50520.md): WordPress Ancient World Linked Data plugin \<= 0.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Peter J. Herrel Ancient World Linked Data)
- [CVE-2024-50521](https://cve.now/CVE-2024-50521.md): WordPress Alley Elementor Widget plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, alleythemes Alley Elementor Widget)
- [CVE-2024-50522](https://cve.now/CVE-2024-50522.md): WordPress WeChat Subscribers Lite plugin \<= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, redyyu WeChat Subscribers Lite)
- [CVE-2024-50535](https://cve.now/CVE-2024-50535.md): WordPress Step by Step plugin \<= 0.4.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kyle M Brown Step by Step)
- [CVE-2024-50536](https://cve.now/CVE-2024-50536.md): WordPress GDReseller plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tamer Ziady GDReseller)
- [CVE-2024-50537](https://cve.now/CVE-2024-50537.md): WordPress Smart Mockups plugin \<= 1.2.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Stefano Marra Smart Mockups)
- [CVE-2024-50538](https://cve.now/CVE-2024-50538.md): WordPress Show Visitor IP Address plugin \<= 0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, irfantea Show Visitor IP Address)
- [CVE-2024-50540](https://cve.now/CVE-2024-50540.md): WordPress (dp) AddThis plugin \<= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, demixpress (dp) AddThis)
- [CVE-2024-50541](https://cve.now/CVE-2024-50541.md): WordPress Advanced Control Manager plugin \<= 2.16.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, overclokk Advanced Control Manager for WordPress by ItalySt…)
- [CVE-2024-50542](https://cve.now/CVE-2024-50542.md): WordPress RLM Elementor Widgets Pack plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zachsilberstein RLM Elementor Widgets Pack)
- [CVE-2024-50543](https://cve.now/CVE-2024-50543.md): WordPress amazing neo icon font for elementor plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mudssar amazing neo icon font for elementor)
- [CVE-2024-50545](https://cve.now/CVE-2024-50545.md): WordPress DataMentor plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AuburnForest DataMentor)
- [CVE-2024-50546](https://cve.now/CVE-2024-50546.md): WordPress MyOrderDesk plugin \<= 3.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Riley Magnuson MyOrderDesk)
- [CVE-2024-50547](https://cve.now/CVE-2024-50547.md): WordPress Themedy Toolbox plugin \<= 1.0.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mark Hodder Themedy Toolbox)
- [CVE-2024-50548](https://cve.now/CVE-2024-50548.md): WordPress Awesome Progress Bar plugin \<= 1.0.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Abdullah Nahian Awesome Progress Bar)
- [CVE-2024-50549](https://cve.now/CVE-2024-50549.md): WordPress Bonway Static Block Editor plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Steven Nolles Bonway Static Block Editor)
- [CVE-2024-50551](https://cve.now/CVE-2024-50551.md): WordPress EndomondoWP plugin \<= 0.1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Odyno EndomondoWP)
- [CVE-2024-50552](https://cve.now/CVE-2024-50552.md): WordPress Hover Video Preview plugin \<= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jasonpancake Hover Video Preview)
- [CVE-2024-50553](https://cve.now/CVE-2024-50553.md): WordPress Classy Addons for Elementor plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Classy Addons for Elementor)
- [CVE-2024-50554](https://cve.now/CVE-2024-50554.md): WordPress Sided plugin \<= 1.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sided)
- [CVE-2024-50556](https://cve.now/CVE-2024-50556.md): WordPress WM Zoom plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WorldMarkerter WM Zoom)
- [CVE-2024-51617](https://cve.now/CVE-2024-51617.md): WordPress Clyp plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Clyp)
- [CVE-2024-51794](https://cve.now/CVE-2024-51794.md): WordPress Storely theme \<= 14.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sellerthemes Storely)
- [CVE-2024-51795](https://cve.now/CVE-2024-51795.md): WordPress Pdf Embedder Fay plugin \<= 1.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, fayjur Pdf Embedder Fay)
- [CVE-2024-51796](https://cve.now/CVE-2024-51796.md): WordPress Trendy Restaurant Menu plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Shahjahan Jewel Trendy Restaurant Menu)
- [CVE-2024-51797](https://cve.now/CVE-2024-51797.md): WordPress Ultimate Accordion plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Md. Shiddikur Rahman Ultimate Accordion)
- [CVE-2024-51798](https://cve.now/CVE-2024-51798.md): WordPress Surbma | Font Awesome plugin \<= 3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Surbma | Font Awesome)
- [CVE-2024-51799](https://cve.now/CVE-2024-51799.md): WordPress Bg Patriarchia BU plugin \<= 2.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vadim Bogaiskov Bg Patriarchia BU)
- [CVE-2024-51801](https://cve.now/CVE-2024-51801.md): WordPress Brand my Footer plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jakeatthrive Brand my Footer)
- [CVE-2024-51802](https://cve.now/CVE-2024-51802.md): WordPress Bread & Butter plugin \<= 7.4.857 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bread & Butter)
- [CVE-2024-51803](https://cve.now/CVE-2024-51803.md): WordPress Inline Click To Tweet plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Magnetic Creative Inline Click To Tweet)
- [CVE-2024-51804](https://cve.now/CVE-2024-51804.md): WordPress Moka Get Posts Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bobmatnyc Moka Get Posts Shortcode)
- [CVE-2024-51805](https://cve.now/CVE-2024-51805.md): WordPress yPHPlista plugin \<= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, yonisink yPHPlista)
- [CVE-2024-51806](https://cve.now/CVE-2024-51806.md): WordPress Awesome Fitness Testimonials plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Shingo Awesome Fitness Testimonials)
- [CVE-2024-51807](https://cve.now/CVE-2024-51807.md): WordPress AgendaPress plugin \<= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Black and White AgendaPress – Easily Publish Meeting Agenda…)
- [CVE-2024-51808](https://cve.now/CVE-2024-51808.md): WordPress codeSnips plugin \<= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pat O’Brien codeSnips)
- [CVE-2024-51809](https://cve.now/CVE-2024-51809.md): WordPress Keymaster Chord Notation Free plugin \<= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, intelligentDesign Keymaster Chord Notation Free)
- [CVE-2024-51810](https://cve.now/CVE-2024-51810.md): WordPress Lewe Bootstrap Visuals plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, George Lewe Lewe Bootstrap Visuals)
- [CVE-2024-51811](https://cve.now/CVE-2024-51811.md): WordPress Popup Image plugin \<= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hussam Hussien Popup Image)
- [CVE-2024-51812](https://cve.now/CVE-2024-51812.md): WordPress Pro Addons For Elementor plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wasim Pro Addons For Elementor)
- [CVE-2024-51813](https://cve.now/CVE-2024-51813.md): WordPress Anant Addons for Elementor plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, anantaddons Anant Addons for Elementor)
- [CVE-2024-51814](https://cve.now/CVE-2024-51814.md): WordPress 活动链接推广插件 plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, 野人 活动链接推广插件)
- [CVE-2024-51816](https://cve.now/CVE-2024-51816.md): WordPress Banner System plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saul Morales Pacheco Banner System)
- [CVE-2024-51819](https://cve.now/CVE-2024-51819.md): WordPress Tigris Flexplatform plugin \<=1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tigrisflexplatform Tigris Flexplatform)
- [CVE-2024-51821](https://cve.now/CVE-2024-51821.md): WordPress WE – Client Logo Carousel plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wordpresteem WE – Client Logo Carousel)
- [CVE-2024-51822](https://cve.now/CVE-2024-51822.md): WordPress Creative Blocks plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, keonthemes Creative Blocks)
- [CVE-2024-51823](https://cve.now/CVE-2024-51823.md): WordPress Add Ribbon Shortcode plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SherkSpear Add Ribbon Shortcode)
- [CVE-2024-51824](https://cve.now/CVE-2024-51824.md): WordPress Advanced Video Player with Analytics plugin \<= 1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Karam Singh Advanced Video Player with Analytics)
- [CVE-2024-51825](https://cve.now/CVE-2024-51825.md): WordPress Alert Me! plugin \<= 0.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, crissoca Alert Me!)
- [CVE-2024-51826](https://cve.now/CVE-2024-51826.md): WordPress Bitcoin Payments plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jandal Bitcoin Payments)
- [CVE-2024-51827](https://cve.now/CVE-2024-51827.md): WordPress Boombox Shortcode plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Movement Ventures Boombox Shortcode)
- [CVE-2024-51828](https://cve.now/CVE-2024-51828.md): WordPress Beacon For Help Scout plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Dan Griffiths Beacon For Help Scout)
- [CVE-2024-51829](https://cve.now/CVE-2024-51829.md): WordPress Mobile Kiosk plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, figoliquinn Mobile Kiosk)
- [CVE-2024-51830](https://cve.now/CVE-2024-51830.md): WordPress News Ticker plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fazilatunnesa News Ticker)
- [CVE-2024-51831](https://cve.now/CVE-2024-51831.md): WordPress Persian Nested Show/Hide Text plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aboutorab Pourhaghani Persian Nested Show/Hide Text)
- [CVE-2024-51832](https://cve.now/CVE-2024-51832.md): WordPress Plenigo plugin \<= 1.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Plenigo)
- [CVE-2024-51833](https://cve.now/CVE-2024-51833.md): WordPress Easy Social Sharebar plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nomaniplex Easy Social Sharebar)
- [CVE-2024-51834](https://cve.now/CVE-2024-51834.md): WordPress Luzuk Slider plugin \<= 0.1.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, luzuk Themes Luzuk Slider)
- [CVE-2024-51835](https://cve.now/CVE-2024-51835.md): WordPress OpenCart Product Display plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ajinkyanahar OpenCart Product Display)
- [CVE-2024-51836](https://cve.now/CVE-2024-51836.md): WordPress Wezido plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, teconce Wezido)
- [CVE-2024-51838](https://cve.now/CVE-2024-51838.md): WordPress Pull This plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, smajda Pull This)
- [CVE-2024-51839](https://cve.now/CVE-2024-51839.md): WordPress Utech Spinning Earth plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Meini Utech Spinning Earth)
- [CVE-2024-51840](https://cve.now/CVE-2024-51840.md): WordPress Wd-image-magnifier-xoss plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, rezaul Wd-image-magnifier-xoss)
- [CVE-2024-51841](https://cve.now/CVE-2024-51841.md): WordPress File Select Control For Elementor plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Abdul Awal Uzzal File Select Control For Elementor)
- [CVE-2024-51842](https://cve.now/CVE-2024-51842.md): WordPress Image Carousel Shortcode plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sazzad Image Carousel Shortcode)
- [CVE-2024-51844](https://cve.now/CVE-2024-51844.md): WordPress Location Click Map plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kiran Patil Location Click Map)
- [CVE-2024-51846](https://cve.now/CVE-2024-51846.md): WordPress Community Yard Sale plugin \<= 1.1.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Simpson Community Yard Sale)
- [CVE-2024-51847](https://cve.now/CVE-2024-51847.md): WordPress WP PagSeguro Payments plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, giovanebribeiro WP PagSeguro Payments)
- [CVE-2024-51848](https://cve.now/CVE-2024-51848.md): WordPress Parallaxer plugin \<= 1.00 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, digitalzoomstudio Parallaxer)
- [CVE-2024-51849](https://cve.now/CVE-2024-51849.md): WordPress My Restaurant Menu plugin \<= 0.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Marco Piarulli My Restaurant Menu)
- [CVE-2024-51850](https://cve.now/CVE-2024-51850.md): WordPress WoW Guild Armory Roster plugin \<= 0.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bchristopeit WoW Guild Armory Roster)
- [CVE-2024-51851](https://cve.now/CVE-2024-51851.md): WordPress best bootstrap widgets for elementor plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, salehattari best bootstrap widgets for elementor)
- [CVE-2024-51852](https://cve.now/CVE-2024-51852.md): WordPress Dynamic Post Grid Elementor Addon plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maidul Dynamic Post Grid Elementor Addon)
- [CVE-2024-51853](https://cve.now/CVE-2024-51853.md): WordPress Faltu Testimonial Rotator plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alberuni Azad. Faltu Testimonial Rotator)
- [CVE-2024-51854](https://cve.now/CVE-2024-51854.md): WordPress Hola Free Video Player plugin \<= 1.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, holanetworks Hola Free Video Player)
- [CVE-2024-51855](https://cve.now/CVE-2024-51855.md): WordPress Redirecter plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Productineer Redirecter)
- [CVE-2024-51856](https://cve.now/CVE-2024-51856.md): WordPress Moose Elementor Kit plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ibllex Moose Elementor Kit)
- [CVE-2024-51857](https://cve.now/CVE-2024-51857.md): WordPress Olympus Shortcodes plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DannyCooper Olympus Shortcodes)
- [CVE-2024-51858](https://cve.now/CVE-2024-51858.md): WordPress Social Locker plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginOps Social Locker)
- [CVE-2024-51859](https://cve.now/CVE-2024-51859.md): WordPress Bamboo Enquiries plugin \<= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bamboo Manchester Bamboo Enquiries)
- [CVE-2024-51860](https://cve.now/CVE-2024-51860.md): WordPress Custom Dashboard Widget plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DuoGeek Custom Dashboard Widget)
- [CVE-2024-51861](https://cve.now/CVE-2024-51861.md): WordPress EventPress plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DuoGeek EventPress)
- [CVE-2024-51862](https://cve.now/CVE-2024-51862.md): WordPress Google Visualization Charts plugin \<= 0.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Baptiste Wicht Google Visualization Charts)
- [CVE-2024-51863](https://cve.now/CVE-2024-51863.md): WordPress PF Timer plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Profit Funnels PF Timer)
- [CVE-2024-51864](https://cve.now/CVE-2024-51864.md): WordPress Shortcode Collection plugin \<= 1.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Agnel Waghela Shortcode Collection)
- [CVE-2024-51865](https://cve.now/CVE-2024-51865.md): WordPress Simple Social Share Block plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, leroysabrina Simple Social Share Block)
- [CVE-2024-51866](https://cve.now/CVE-2024-51866.md): WordPress Social button plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, riponshah Social button)
- [CVE-2024-51867](https://cve.now/CVE-2024-51867.md): WordPress Simpul Events by Esotech plugin \<= 1.8.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, geilt Simpul Events by Esotech)
- [CVE-2024-51868](https://cve.now/CVE-2024-51868.md): WordPress DuoGeek Blocks plugin \<= 0.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tapan Kumer Das DuoGeek Blocks)
- [CVE-2024-51869](https://cve.now/CVE-2024-51869.md): WordPress Gutenium Blocks plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Best WP Developer Gutenium Blocks)
- [CVE-2024-51870](https://cve.now/CVE-2024-51870.md): WordPress Ultimate Flipbox Addon for Elementor plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dragwyb Ultimate Flipbox Addon for Elementor)
- [CVE-2024-51871](https://cve.now/CVE-2024-51871.md): WordPress Luzuk Team plugin \<= 0.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, luzuk Themes Luzuk Team)
- [CVE-2024-51872](https://cve.now/CVE-2024-51872.md): WordPress Luzuk Testimonials plugin \<= 0.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, luzuk Themes Luzuk Testimonials)
- [CVE-2024-51873](https://cve.now/CVE-2024-51873.md): WordPress Multi-day Booking Calendar plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Masashi Takizawa Multi-day Booking Calendar)
- [CVE-2024-51874](https://cve.now/CVE-2024-51874.md): WordPress ParOne Feeds plugin \<= 1.17.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ParOne Feeds)
- [CVE-2024-51875](https://cve.now/CVE-2024-51875.md): WordPress MDC YouTube Downloader plugin \<= 3.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nazmul Ahsan MDC YouTube Downloader)
- [CVE-2024-51876](https://cve.now/CVE-2024-51876.md): WordPress wp\_automatic\_widget plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Codstack wp\_automatic\_widget)
- [CVE-2024-51877](https://cve.now/CVE-2024-51877.md): WordPress SV Forms plugin \<= 2.0.05 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, straightvisions SV Forms)
- [CVE-2024-51878](https://cve.now/CVE-2024-51878.md): WordPress AchillesTheme-shortcodes plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, strailejoey AchillesTheme-shortcodes)
- [CVE-2024-51879](https://cve.now/CVE-2024-51879.md): WordPress Text Advertisements plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Arash Heidari Text Advertisements)
- [CVE-2024-51880](https://cve.now/CVE-2024-51880.md): WordPress BeBetter Social Icons plugin \<= 2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sistemasBebetter BeBetter Social Icons)
- [CVE-2024-51881](https://cve.now/CVE-2024-51881.md): WordPress Be Shortcodes plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Beautimour Be Shortcodes)
- [CVE-2024-51883](https://cve.now/CVE-2024-51883.md): WordPress I Plant A Tree plugin \<= 1.7.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Micha I Plant A Tree)
- [CVE-2024-51884](https://cve.now/CVE-2024-51884.md): WordPress Posts Search plugin \<= 1.2.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Matsuyama Posts Search)
- [CVE-2024-51885](https://cve.now/CVE-2024-51885.md): WordPress Browsing History plugin \<= 1.3.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Matsuyama Browsing History)
- [CVE-2024-51886](https://cve.now/CVE-2024-51886.md): WordPress Posts Filter plugin \<= 1.3.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Matsuyama Posts Filter)
- [CVE-2024-51887](https://cve.now/CVE-2024-51887.md): WordPress NV Slider plugin \<= 1.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ryscript NV Slider)
- [CVE-2024-51889](https://cve.now/CVE-2024-51889.md): WordPress Fancy User List plugin \<= 3.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GeroNikolov Fancy User List)
- [CVE-2024-51890](https://cve.now/CVE-2024-51890.md): WordPress Geoportail Shortcode plugin \<= 2.4.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, geoWP Geoportail Shortcode)
- [CVE-2024-51891](https://cve.now/CVE-2024-51891.md): WordPress Official SalesWizard CRM Plugin plugin \<= 1.0.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SalesWizard.pl Official SalesWizard CRM Plugin)
- [CVE-2024-51892](https://cve.now/CVE-2024-51892.md): WordPress Sell Media File with Stripe plugin \<= 1.0.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor Alam Sell Media File with Stripe)
- [CVE-2024-51893](https://cve.now/CVE-2024-51893.md): WordPress Postify: Post Layout For Elementor plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FixoLab Postify: Post Layout For Elementor)
- [CVE-2024-51894](https://cve.now/CVE-2024-51894.md): WordPress Topbar ID for Elementor plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, reyzua Topbar ID for Elementor)
- [CVE-2024-51895](https://cve.now/CVE-2024-51895.md): WordPress Minical Hotel Booking Plugin plugin \<= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, pankaj9296 Minical Hotel Booking Plugin)
- [CVE-2024-51896](https://cve.now/CVE-2024-51896.md): WordPress Magic Slider plugin \<= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webvitaly Magic Slider)
- [CVE-2024-51897](https://cve.now/CVE-2024-51897.md): WordPress News Articles plugin \<= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Erik Saulnier News Articles)
- [CVE-2024-51898](https://cve.now/CVE-2024-51898.md): WordPress Semantic Shortcode plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sachin8600 Semantic Shortcode)
- [CVE-2024-51899](https://cve.now/CVE-2024-51899.md): WordPress Simple Pricing Table plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, seothemes Simple Pricing Table)
- [CVE-2024-51901](https://cve.now/CVE-2024-51901.md): WordPress Smooth Maps plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wojciechborowicz Smooth Maps)
- [CVE-2024-51902](https://cve.now/CVE-2024-51902.md): WordPress TinyCode plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cybio TinyCode)
- [CVE-2024-51903](https://cve.now/CVE-2024-51903.md): WordPress WP Listings Pro plugin \<= 3.0.14 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brandon Hubbard WP Listings Pro)
- [CVE-2024-51904](https://cve.now/CVE-2024-51904.md): WordPress Embed documents shortcode plugin \<= 1.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Joan Boluda Embed documents shortcode)
- [CVE-2024-51905](https://cve.now/CVE-2024-51905.md): WordPress RSV PDF Preview plugin \<= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ravi Kumar Vanukuru RSV PDF Preview)
- [CVE-2024-51906](https://cve.now/CVE-2024-51906.md): WordPress RSV 360 View plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ravi Kumar Vanukuru RSV 360 View)
- [CVE-2024-51907](https://cve.now/CVE-2024-51907.md): WordPress WP Virtual Room Configurator plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Codemenschen WP Virtual Room Configurator)
- [CVE-2024-51908](https://cve.now/CVE-2024-51908.md): WordPress Adventure Bucket List plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, kevinabl Adventure Bucket List)
- [CVE-2024-51909](https://cve.now/CVE-2024-51909.md): WordPress audioCase plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Monarkie DCS audioCase)
- [CVE-2024-51910](https://cve.now/CVE-2024-51910.md): WordPress Assist24 Help Desk plugin \<= 20150401.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ezlab Assist24 Help Desk)
- [CVE-2024-51911](https://cve.now/CVE-2024-51911.md): WordPress Featured product by category name plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ketan Patel Featured product by category name)
- [CVE-2024-51912](https://cve.now/CVE-2024-51912.md): WordPress IntelliWidget Elements plugin \<= 2.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lilaeamedia IntelliWidget Elements)
- [CVE-2024-51913](https://cve.now/CVE-2024-51913.md): WordPress Mapme plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mapme)
- [CVE-2024-51914](https://cve.now/CVE-2024-51914.md): WordPress drop in image slideshow gallery plugin \<= 12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, gopiplus drop in image slideshow gallery)
- [CVE-2024-51916](https://cve.now/CVE-2024-51916.md): WordPress Multifox Plus plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Creative Brahma Multifox Plus)
- [CVE-2024-51917](https://cve.now/CVE-2024-51917.md): WordPress Multiple Votes in one page plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lequanghuylc Multiple Votes in one page)
- [CVE-2024-51918](https://cve.now/CVE-2024-51918.md): WordPress Pay With Stripe plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Freshlight Lab Pay With Stripe)
- [CVE-2024-51920](https://cve.now/CVE-2024-51920.md): WordPress Map Store Locator plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pierre Jégo Map Store Locator)
- [CVE-2024-51921](https://cve.now/CVE-2024-51921.md): WordPress scrollup plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, midori scrollup)
- [CVE-2024-51922](https://cve.now/CVE-2024-51922.md): WordPress VP Sitemap plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maruf Arafat VP Sitemap)
- [CVE-2024-51923](https://cve.now/CVE-2024-51923.md): WordPress Websand Subscription Form plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Websand Subscription Form)
- [CVE-2024-51924](https://cve.now/CVE-2024-51924.md): WordPress WP Agenda plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, alexandremagno WP Agenda)
- [CVE-2024-51925](https://cve.now/CVE-2024-51925.md): WordPress Testimonial Slider Shortcode plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sazzad Testimonial Slider Shortcode)
- [CVE-2024-51926](https://cve.now/CVE-2024-51926.md): WordPress GreenCon plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpsoul GreenCon)
- [CVE-2024-51927](https://cve.now/CVE-2024-51927.md): WordPress Rig Elements For Elementor plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Asaduzzaman Abir Rig Elements For Elementor)
- [CVE-2024-51928](https://cve.now/CVE-2024-51928.md): WordPress Blocks Post Grid plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jakir Hasan Blocks Post Grid)
- [CVE-2024-51929](https://cve.now/CVE-2024-51929.md): WordPress Icon Widget plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, philspectrum Icon Widget)
- [CVE-2024-51930](https://cve.now/CVE-2024-51930.md): WordPress Custom URL Shortener plugin \<= 0.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IronFeet Custom URL Shortener)
- [CVE-2024-51931](https://cve.now/CVE-2024-51931.md): WordPress AzonBox plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Shazahanul Islam Shohag AzonBox)
- [CVE-2024-51932](https://cve.now/CVE-2024-51932.md): WordPress Kings Tab Slider plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saif Kings Tab Slider)
- [CVE-2024-51933](https://cve.now/CVE-2024-51933.md): WordPress Cookie Nonsense for YT plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, dozyde Cookie Nonsense for YT)
- [CVE-2024-51934](https://cve.now/CVE-2024-51934.md): WordPress Ekiline Block Collection plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Uri Lazcano Ekiline Block Collection)
- [CVE-2024-51935](https://cve.now/CVE-2024-51935.md): WordPress Fast Video and Image Display plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sam Perrow Fast Video and Image Display)
- [CVE-2024-51936](https://cve.now/CVE-2024-51936.md): WordPress ESB Testimonials plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, eSparkBiz ESB Testimonials)
- [CVE-2024-51937](https://cve.now/CVE-2024-51937.md): WordPress IA Map Analytics Basic plugin \<= 20170413 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bnisia IA Map Analytics Basic)
- [CVE-2024-51938](https://cve.now/CVE-2024-51938.md): WordPress Charity Addon for Elementor plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Charity Addon for Elementor)
- [CVE-2024-49680](https://cve.now/CVE-2024-49680.md): WordPress WP VR plugin \<= 8.5.5 - Broken Access Control vulnerability (CVSS 4.3, RexTheme WP VR)
- [CVE-2024-49689](https://cve.now/CVE-2024-49689.md): WordPress HD Quiz – Save Results Light plugin \<= 0.5 - Broken Access Control vulnerability (CVSS 5.4, Harmonic Design HD Quiz – Save Results Light)
- [CVE-2024-49697](https://cve.now/CVE-2024-49697.md): WordPress Sunshine Photo Cart plugin \<= 3.2.9 - Broken Access Control vulnerability (CVSS 4.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-50417](https://cve.now/CVE-2024-50417.md): WordPress Bold Page Builder plugin \<= 5.1.3 - Broken Access Control vulnerability (CVSS 4.3, boldthemes Bold Page Builder)
- [CVE-2024-51660](https://cve.now/CVE-2024-51660.md): WordPress Easy Accordion Gutenberg Block plugin \<= 1.2.3 - Broken Access Control vulnerability (CVSS 4.3, Binsaifullah Easy Accordion Gutenberg Block)
- [CVE-2024-51671](https://cve.now/CVE-2024-51671.md): WordPress Otter Blocks plugin \<= 3.0.3 - Broken Access Control vulnerability (CVSS 2.7, Themeisle Otter - Gutenberg Block)
- [CVE-2024-51817](https://cve.now/CVE-2024-51817.md): WordPress Combo WP Rewrite Slugs plugin \<= 1.0 - Settings Change vulnerability (CVSS 5.4, CodeZel Combo WP Rewrite Slugs)
- [CVE-2024-52395](https://cve.now/CVE-2024-52395.md): WordPress Floating Buttons for WooCommerce plugin \<= 2.8.8 - Broken Access Control vulnerability (CVSS 5.3, QuantumCloud Floating Buttons for WooCommerce)
- [CVE-2024-52600](https://cve.now/CVE-2024-52600.md): Statamic CMS has Path Traversal in Asset Upload (CVSS 5.3, statamic cms · statamic/cms)
- [CVE-2024-52582](https://cve.now/CVE-2024-52582.md): cachi2 allows traceback prints locals (CVSS 4.7, containerbuildsystem cachi2)
- [CVE-2024-10524](https://cve.now/CVE-2024-10524.md): GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs (CVSS 6.5, gnu wget)
- [CVE-2024-10204](https://cve.now/CVE-2024-10204.md): Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 2025 (CVSS 7.8, Dassault Systèmes eDrawings)
- [CVE-2024-11075](https://cve.now/CVE-2024-11075.md): SICK Incoming Goods Suite privilege escalation vulnerability (CVSS 8.8, SICK AG SICK Incoming Goods Suite)
- [CVE-2024-9777](https://cve.now/CVE-2024-9777.md): Ashe \<= 2.243 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, wproyal Ashe)
- [CVE-2024-9830](https://cve.now/CVE-2024-9830.md): Bard \<= 2.216 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, wproyal Bard)
- [CVE-2024-11198](https://cve.now/CVE-2024-11198.md): GD Rating System \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra\_class Parameter (CVSS 6.4, gdragon GD Rating System)
- [CVE-2024-11224](https://cve.now/CVE-2024-11224.md): Parallax Image \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter (CVSS 6.4, thehowarde Parallax Image)
- [CVE-2024-11194](https://cve.now/CVE-2024-11194.md): Classified Listing – Classified ads & Business Directory Plugin \<= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update (CVSS 8.8, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2024-11195](https://cve.now/CVE-2024-11195.md): Email Subscription Popup \<= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print\_email\_subscribe\_form Shortcode (CVSS 6.4, nik00726 Email Subscription Popup)
- [CVE-2024-11036](https://cve.now/CVE-2024-11036.md): GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress \<= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress\_get\_user\_earnings (CVSS 7.3, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2024-11038](https://cve.now/CVE-2024-11038.md): WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup \<= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb\_pcf\_fire\_contact\_form (CVSS 7.3, wpbean WPB Popup for Contact Form 7 – Showing Contact Form…)
- [CVE-2024-31141](https://cve.now/CVE-2024-31141.md): Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider (CVSS 6.5, Apache Software Foundation Apache Kafka Clients · org.apach…)
- [CVE-2024-10388](https://cve.now/CVE-2024-10388.md): WordPress GDPR \<= 2.0.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, welaunch WordPress GDPR)
- [CVE-2024-11069](https://cve.now/CVE-2024-11069.md): WordPress GDPR \<= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion (CVSS 6.5, welaunch WordPress GDPR)
- [CVE-2024-10268](https://cve.now/CVE-2024-10268.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar \<= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar\_audioplayer Shortcode (CVSS 6.4, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2024-11098](https://cve.now/CVE-2024-11098.md): SVG Block \<= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload (CVSS 5.5, mr2p SVG Block)
- [CVE-2024-10103](https://cve.now/CVE-2024-10103.md): MailPoet \< 5.3.2 - Admin+ Stored XSS (CVSS 6.1, MailPoet)
- [CVE-2024-8403](https://cve.now/CVE-2024-8403.md): Denial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP Module (CVSS 7.5, Mitsubishi Electric MELSEC iQ-F Series FX5-ENET · Mitsubish…)
- [CVE-2024-21539](https://cve.now/CVE-2024-21539.md): Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input (CVSS 8.7, @eslint/plugin-kit)
- [CVE-2024-50302](https://cve.now/CVE-2024-50302.md): HID: core: zero-initialize the report buffer (CVSS 5.5, KEV, Linux · :linux\_kernel:)
- [CVE-2024-50301](https://cve.now/CVE-2024-50301.md): security/keys: fix slab-out-of-bounds in key\_task\_permission (CVSS 7.8, Linux)
- [CVE-2024-50300](https://cve.now/CVE-2024-50300.md): regulator: rtq2208: Fix uninitialized use of regulator\_config (CVSS 7.8, Linux)
- [CVE-2024-50299](https://cve.now/CVE-2024-50299.md): sctp: properly validate chunk size in sctp\_sf\_ootb() (CVSS 8.2, Linux)
- [CVE-2024-50298](https://cve.now/CVE-2024-50298.md): net: enetc: allocate vf\_state during PF probes (CVSS 5.5, Linux)
- [CVE-2024-50297](https://cve.now/CVE-2024-50297.md): net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts (CVSS 7.5, Linux)
- [CVE-2024-50296](https://cve.now/CVE-2024-50296.md): net: hns3: fix kernel crash when uninstalling driver (CVSS 5.5, Linux)
- [CVE-2024-50295](https://cve.now/CVE-2024-50295.md): net: arc: fix the device for dma\_map\_single/dma\_unmap\_single (no CVSS, Linux)
- [CVE-2024-50294](https://cve.now/CVE-2024-50294.md): rxrpc: Fix missing locking causing hanging calls (CVSS 7.8, Linux)
- [CVE-2024-50293](https://cve.now/CVE-2024-50293.md): net/smc: do not leave a dangling sk pointer in \_\_smc\_create() (CVSS 7.8, Linux)
- [CVE-2024-50292](https://cve.now/CVE-2024-50292.md): ASoC: stm32: spdifrx: fix dma channel release in stm32\_spdifrx\_remove (CVSS 5.5, Linux)
- [CVE-2024-50291](https://cve.now/CVE-2024-50291.md): media: dvb-core: add missing buffer index check (CVSS 7.8, Linux)
- [CVE-2024-50290](https://cve.now/CVE-2024-50290.md): media: cx24116: prevent overflows on SNR calculus (CVSS 5.5, Linux)
- [CVE-2024-50289](https://cve.now/CVE-2024-50289.md): media: av7110: fix a spectre vulnerability (no CVSS, Linux)
- [CVE-2024-50288](https://cve.now/CVE-2024-50288.md): media: vivid: fix buffer overwrite when using \> 32 buffers (CVSS 7.8, Linux)
- [CVE-2024-50287](https://cve.now/CVE-2024-50287.md): media: v4l2-tpg: prevent the risk of a division by zero (CVSS 5.5, Linux)
- [CVE-2024-50286](https://cve.now/CVE-2024-50286.md): ksmbd: fix slab-use-after-free in ksmbd\_smb2\_session\_create (CVSS 9.8, Linux)
- [CVE-2024-50285](https://cve.now/CVE-2024-50285.md): ksmbd: check outstanding simultaneous SMB operations (CVSS 7.5, Linux)
- [CVE-2024-50284](https://cve.now/CVE-2024-50284.md): ksmbd: Fix the missing xa\_store error check (CVSS 7.5, Linux)
- [CVE-2024-50283](https://cve.now/CVE-2024-50283.md): ksmbd: fix slab-use-after-free in smb3\_preauth\_hash\_rsp (CVSS 9.8, Linux)
- [CVE-2024-50282](https://cve.now/CVE-2024-50282.md): drm/amdgpu: add missing size check in amdgpu\_debugfs\_gprwave\_read() (CVSS 7.8, Linux)
- [CVE-2024-50281](https://cve.now/CVE-2024-50281.md): KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation (CVSS 7.8, Linux)
- [CVE-2024-50280](https://cve.now/CVE-2024-50280.md): dm cache: fix flushing uninitialized delayed\_work on cache\_ctr error (CVSS 7.8, Linux)
- [CVE-2024-50279](https://cve.now/CVE-2024-50279.md): dm cache: fix out-of-bounds access to the dirty bitset when resizing (CVSS 7.1, Linux)
- [CVE-2024-50278](https://cve.now/CVE-2024-50278.md): dm cache: fix potential out-of-bounds access on the first resume (CVSS 7.1, Linux)
- [CVE-2024-50277](https://cve.now/CVE-2024-50277.md): dm: fix a crash if blk\_alloc\_disk fails (CVSS 4.7, Linux)
- [CVE-2024-50276](https://cve.now/CVE-2024-50276.md): net: vertexcom: mse102x: Fix possible double free of TX skb (CVSS 9.8, Linux)
- [CVE-2024-50275](https://cve.now/CVE-2024-50275.md): arm64/sve: Discard stale CPU state when handling SVE traps (CVSS 7.3, Linux)
- [CVE-2024-50274](https://cve.now/CVE-2024-50274.md): idpf: avoid vport access in idpf\_get\_link\_ksettings (CVSS 7.8, Linux)
- [CVE-2024-50273](https://cve.now/CVE-2024-50273.md): btrfs: reinitialize delayed ref list after deleting it from the list (CVSS 7.8, Linux)
- [CVE-2024-50272](https://cve.now/CVE-2024-50272.md): filemap: Fix bounds checking in filemap\_read() (no CVSS, Linux)
- [CVE-2024-50271](https://cve.now/CVE-2024-50271.md): signal: restore the override\_rlimit logic (CVSS 5.5, Linux)
- [CVE-2024-50270](https://cve.now/CVE-2024-50270.md): mm/damon/core: avoid overflow in damon\_feed\_loop\_next\_input() (CVSS 5.5, Linux)
- [CVE-2024-50269](https://cve.now/CVE-2024-50269.md): usb: musb: sunxi: Fix accessing an released usb phy (CVSS 7.8, Linux)
- [CVE-2024-50268](https://cve.now/CVE-2024-50268.md): usb: typec: fix potential out of bounds in ucsi\_ccg\_update\_set\_new\_cam\_cmd() (CVSS 7.8, Linux)
- [CVE-2024-50267](https://cve.now/CVE-2024-50267.md): USB: serial: io\_edgeport: fix use after free in debug printk (CVSS 7.8, Linux)
- [CVE-2024-50266](https://cve.now/CVE-2024-50266.md): clk: qcom: videocc-sm8350: use HW\_CTRL\_TRIGGER for vcodec GDSCs (CVSS 5.5, Linux)
- [CVE-2024-50265](https://cve.now/CVE-2024-50265.md): ocfs2: remove entry once instead of null-ptr-dereference in ocfs2\_xa\_remove() (CVSS 5.5, Linux)
- [CVE-2024-50264](https://cve.now/CVE-2024-50264.md): vsock/virtio: Initialization of the dangling pointer occurring in vsk-\>trans (CVSS 7.8, Linux)
- [CVE-2023-52921](https://cve.now/CVE-2023-52921.md): drm/amdgpu: fix possible UAF in amdgpu\_cs\_pass1() (CVSS 7.8, Linux)
- [CVE-2024-48069](https://cve.now/CVE-2024-48069.md): A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files an (CVSS 9.8)
- [CVE-2024-48070](https://cve.now/CVE-2024-48070.md): An issue in Weaver E-cology v. (CVSS 9.8)
- [CVE-2024-48071](https://cve.now/CVE-2024-48071.md): E-cology has a directory traversal vulnerability. (CVSS 6.5)
- [CVE-2024-48072](https://cve.now/CVE-2024-48072.md): Weaver Ecology v9.\* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.form (CVSS 9.8)
- [CVE-2024-48694](https://cve.now/CVE-2024-48694.md): File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arb (CVSS 9.8)
- [CVE-2024-50803](https://cve.now/CVE-2024-50803.md): The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker (CVSS 6.1, redaxo/source)
- [CVE-2024-52675](https://cve.now/CVE-2024-52675.md): SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php. (CVSS 9.8)
- [CVE-2024-52711](https://cve.now/CVE-2024-52711.md): DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip\_position\_asp function via the ip parameter. (CVSS 5.7)
- [CVE-2024-52714](https://cve.now/CVE-2024-52714.md): Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime. (CVSS 8.1)
- [CVE-2024-52759](https://cve.now/CVE-2024-52759.md): D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip\_position\_asp function. (CVSS 3.5)
- [CVE-2024-52762](https://cve.now/CVE-2024-52762.md): A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arb (CVSS 6.1)
- [CVE-2024-52763](https://cve.now/CVE-2024-52763.md): A cross-site scripting (XSS) vulnerability in the component /graph\_all\_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute (CVSS 6.1)
- [CVE-2024-52788](https://cve.now/CVE-2024-52788.md): Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc\_ro/shadow, which allows attackers to log in as (CVSS 8.0)
- [CVE-2024-52789](https://cve.now/CVE-2024-52789.md): Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc\_ro/shadow, which allows attackers to log in (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.