CVEs published November 23, 2024
45 CVEs were published on November 23, 2024: 4 critical, 6 high.
- Published
- 45
- Critical
- 4
- High
- 6
- Medium
- 35
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- dasinfomedia School Management System for Wordpress
- 2
- dasinfomedia WPGYM - Wordpress Gym Management System
- 2
- wpusermanager WP User Manager – User Profile Builder & Memb…
- 2
- alexmoss FireCask’s Twitter Follow Button
- 1
- boomdevs Tribute Testimonials – WordPress Testimonial Grid/…
- 1
- Canonical Ubuntu's pulseaudio
- 1
- choijun LA-Studio Element Kit for Elementor
- 1
- claudeschlesser Social Login
- 1
- code-projects Simple Car Rental System
- 1
- codemstory 우커머스 네이버페이
- 1
Critical 4
- CVE-2024-9659School Management <= 91.5.0 - Unauthenticated Arbitrary File Uploaddasinfomedia School Management System for Wordpress
- CVE-2024-9942WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Uploaddasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2024-9511FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injectiontechjewel FluentSMTP – WP SMTP Plugin with Amazon SES, Send…
- CVE-2024-10961Social Login <= 5.9.0 - Authentication Bypass via Disqus OAuth providerclaudeschlesser Social Login
High 6
- CVE-2024-11034Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_formwpbean Request a Quote for WooCommerce – Get a Quote Button
- CVE-2024-9941WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationdasinfomedia WPGYM - Wordpress Gym Management System
- CVE-2024-10803MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/DownloadFWDesign MP3 Sticky Player
- CVE-2024-9660School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Uploaddasinfomedia School Management System for Wordpress
- CVE-2024-10873LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusionchoijun LA-Studio Element Kit for Elementor
- CVE-2024-11415WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalationmeloniq WP-Orphanage Extended
Medium, low and unrated 35
- CVE-2024-35160IBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosureIBM Watson Query for Cloud Pak for Data · IBM Db2 Big SQL o…
- CVE-2024-11632code-projects Simple Car Rental System book_car.php sql injectioncode-projects Simple Car Rental System
- CVE-2023-7299DataGear resolveSql sql injectionDataGear
- CVE-2024-11228워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcodecodemstory 워드프레스 결제 심플페이 – 우커머스 결제 플러그인
- CVE-2024-11229코드엠샵 소셜톡 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodescodemstory 코드엠샵 소셜톡
- CVE-2024-11631itsourcecode Tailoring Management System expedit.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-11231우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcodecodemstory 우커머스 네이버페이
- CVE-2024-10519Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameterkarzin Wishlist for WooCommerce: Multi Wishlists Per Custom…
- CVE-2024-11199Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcoderescuethemes Rescue Shortcodes
- CVE-2024-11227Memberlite Shortcodes <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcodestrangerstudios Memberlite Shortcodes
- CVE-2024-9635Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scriptingtheafricanboss Checkout with Cash App on WooCommerce
- CVE-2024-11446Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scriptingmpol Chessgame Shizzle
- CVE-2024-11330Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scriptingwpcodefactory Custom CSS, JS & PHP
- CVE-2024-11265Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosurecodepopular EasyMedia – Increase Media Upload File Size | R…
- CVE-2024-11188Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameterstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2024-11361PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scriptingwpcodefactory PDF Invoices & Packing Slips Generator for Wo…
- CVE-2024-11426AutoListicle: Automatically Update Numbered List Articles <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingsomeguy9 AutoListicle: Automatically Update Numbered List A…
- CVE-2024-10606WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Updatewptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2024-11332HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scriptinghipaatizer HIPAA Compliant Forms with Drag’n’Drop HIPAA For…
- CVE-2024-11387Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingjeffreyvr Easy Liveblogs
- CVE-2024-11408Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingteonos Slotti Ajanvaraus
- CVE-2024-10880JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scriptingultimatemember JobBoardWP – Job Board Listings and Submissi…
- CVE-2024-10868Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosurethemelooks Enter Addons – Ultimate Template Builder for Ele…
- CVE-2024-10116Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameteralexmoss FireCask’s Twitter Follow Button
- CVE-2024-10813Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposurecodersaiful Product Table for WooCommerce
- CVE-2024-10537WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumerationwpusermanager WP User Manager – User Profile Builder & Memb…
- CVE-2024-10886Tribute Testimonials – WordPress Testimonial Grid/Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingboomdevs Tribute Testimonials – WordPress Testimonial Grid/…
- CVE-2024-11362Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.112.0 - Reflected Cross-Site ScriptingPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2024-10874Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingoooorgle Quotes llama
- CVE-2024-9223WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposurewpformation WPDash Notes
- CVE-2024-10216WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removalwpusermanager WP User Manager – User Profile Builder & Memb…
- CVE-2024-11463DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site ScriptingDeBounce Email Validator
- CVE-2024-10869GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scriptingguardgiant WordPress Brute Force Protection – Stop Brute Fo…
- CVE-2024-11586Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected.Canonical Ubuntu's pulseaudio
- CVE-2024-41761IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows