# CVEs published 2024-11-23

45 CVEs were published on November 23, 2024: 4 critical, 6 high. Days are UTC.

- [CVE-2024-35160](https://cve.now/CVE-2024-35160.md): IBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosure (CVSS 4.3, IBM Watson Query for Cloud Pak for Data · IBM Db2 Big SQL o…)
- [CVE-2024-11632](https://cve.now/CVE-2024-11632.md): code-projects Simple Car Rental System book\_car.php sql injection (CVSS 6.9, code-projects Simple Car Rental System)
- [CVE-2023-7299](https://cve.now/CVE-2023-7299.md): DataGear resolveSql sql injection (CVSS 5.3, DataGear)
- [CVE-2024-11228](https://cve.now/CVE-2024-11228.md): 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 \<= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw\_instant\_payment Shortcode (CVSS 6.4, codemstory 워드프레스 결제 심플페이 – 우커머스 결제 플러그인)
- [CVE-2024-11229](https://cve.now/CVE-2024-11229.md): 코드엠샵 소셜톡 \<= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add\_plus\_friends and add\_plus\_talk Shortcodes (CVSS 6.4, codemstory 코드엠샵 소셜톡)
- [CVE-2024-11631](https://cve.now/CVE-2024-11631.md): itsourcecode Tailoring Management System expedit.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-11231](https://cve.now/CVE-2024-11231.md): 우커머스 네이버페이 \<= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp\_purchase Shortcode (CVSS 6.4, codemstory 우커머스 네이버페이)
- [CVE-2024-11034](https://cve.now/CVE-2024-11034.md): Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation \<= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire\_contact\_form (CVSS 7.3, wpbean Request a Quote for WooCommerce – Get a Quote Button)
- [CVE-2024-10519](https://cve.now/CVE-2024-10519.md): Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter (CVSS 6.1, karzin Wishlist for WooCommerce: Multi Wishlists Per Custom…)
- [CVE-2024-11199](https://cve.now/CVE-2024-11199.md): Rescue Shortcodes \<= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue\_progressbar Shortcode (CVSS 6.4, rescuethemes Rescue Shortcodes)
- [CVE-2024-11227](https://cve.now/CVE-2024-11227.md): Memberlite Shortcodes \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite\_accordion Shortcode (CVSS 6.4, strangerstudios Memberlite Shortcodes)
- [CVE-2024-9659](https://cve.now/CVE-2024-9659.md): School Management \<= 91.5.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, dasinfomedia School Management System for Wordpress)
- [CVE-2024-9941](https://cve.now/CVE-2024-9941.md): WPGYM \<= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, dasinfomedia WPGYM - Wordpress Gym Management System)
- [CVE-2024-9942](https://cve.now/CVE-2024-9942.md): WPGYM \<= 67.1.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, dasinfomedia WPGYM - Wordpress Gym Management System)
- [CVE-2024-9511](https://cve.now/CVE-2024-9511.md): FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider \<= 2.2.82 - Unauthenticated PHP Object Injection (CVSS 9.8, techjewel FluentSMTP – WP SMTP Plugin with Amazon SES, Send…)
- [CVE-2024-10803](https://cve.now/CVE-2024-10803.md): MP3 Sticky Player \<= 8.0 - Unauthenticated Arbitrary File Read/Download (CVSS 7.5, FWDesign MP3 Sticky Player)
- [CVE-2024-9660](https://cve.now/CVE-2024-9660.md): School Management \<= 91.5.0 - Authenticated (Student+) Arbitrary File Upload (CVSS 8.8, dasinfomedia School Management System for Wordpress)
- [CVE-2024-9635](https://cve.now/CVE-2024-9635.md): Checkout with Cash App on WooCommerce \<= 6.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, theafricanboss Checkout with Cash App on WooCommerce)
- [CVE-2024-11446](https://cve.now/CVE-2024-11446.md): Chessgame Shizzle \<= 1.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, mpol Chessgame Shizzle)
- [CVE-2024-11330](https://cve.now/CVE-2024-11330.md): Custom CSS, JS & PHP \<= 2.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Custom CSS, JS & PHP)
- [CVE-2024-11265](https://cve.now/CVE-2024-11265.md): Wp Maximum Upload File Size \<= 1.1.3 - Authenticated (Author+) Full Path Disclosure (CVSS 4.3, codepopular EasyMedia – Increase Media Upload File Size | R…)
- [CVE-2024-11188](https://cve.now/CVE-2024-11188.md): Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder \<= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter (CVSS 6.1, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2024-11361](https://cve.now/CVE-2024-11361.md): PDF Invoices & Packing Slips Generator for WooCommerce \<= 2.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory PDF Invoices & Packing Slips Generator for Wo…)
- [CVE-2024-11426](https://cve.now/CVE-2024-11426.md): AutoListicle: Automatically Update Numbered List Articles \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, someguy9 AutoListicle: Automatically Update Numbered List A…)
- [CVE-2024-10606](https://cve.now/CVE-2024-10606.md): WP Travel Engine \<= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update (CVSS 4.3, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2024-11332](https://cve.now/CVE-2024-11332.md): HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hipaatizer HIPAA Compliant Forms with Drag’n’Drop HIPAA For…)
- [CVE-2024-11387](https://cve.now/CVE-2024-11387.md): Easy Liveblogs \<= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jeffreyvr Easy Liveblogs)
- [CVE-2024-11408](https://cve.now/CVE-2024-11408.md): Slotti Ajanvaraus \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, teonos Slotti Ajanvaraus)
- [CVE-2024-10873](https://cve.now/CVE-2024-10873.md): LA-Studio Element Kit for Elementor \<= 1.4.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, choijun LA-Studio Element Kit for Elementor)
- [CVE-2024-10880](https://cve.now/CVE-2024-10880.md): JobBoardWP – Job Board Listings and Submissions \<= 1.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, ultimatemember JobBoardWP – Job Board Listings and Submissi…)
- [CVE-2024-10868](https://cve.now/CVE-2024-10868.md): Enter Addons – Ultimate Template Builder for Elementor \<= 2.1.9 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, themelooks Enter Addons – Ultimate Template Builder for Ele…)
- [CVE-2024-10116](https://cve.now/CVE-2024-10116.md): Twitter Follow Button \<= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter (CVSS 6.4, alexmoss FireCask’s Twitter Follow Button)
- [CVE-2024-11415](https://cve.now/CVE-2024-11415.md): WP-Orphanage Extended \<= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation (CVSS 8.8, meloniq WP-Orphanage Extended)
- [CVE-2024-10813](https://cve.now/CVE-2024-10813.md): Product Table for WooCommerce by CodeAstrology (wooproducttable.com) \<= 3.5.1 - Information Exposure (CVSS 5.3, codersaiful Product Table for WooCommerce)
- [CVE-2024-10537](https://cve.now/CVE-2024-10537.md): WP User Manager – User Profile Builder & Membership \<= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration (CVSS 4.3, wpusermanager WP User Manager – User Profile Builder & Memb…)
- [CVE-2024-10886](https://cve.now/CVE-2024-10886.md): Tribute Testimonials – WordPress Testimonial Grid/Slider \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, boomdevs Tribute Testimonials – WordPress Testimonial Grid/…)
- [CVE-2024-11362](https://cve.now/CVE-2024-11362.md): Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net \<= 1.112.0 - Reflected Cross-Site Scripting (CVSS 6.1, PeachPay — Payments & Express Checkout for WooCommerce)
- [CVE-2024-10874](https://cve.now/CVE-2024-10874.md): Quotes llama \<= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oooorgle Quotes llama)
- [CVE-2024-9223](https://cve.now/CVE-2024-9223.md): WPDash Notes \<= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, wpformation WPDash Notes)
- [CVE-2024-10961](https://cve.now/CVE-2024-10961.md): Social Login \<= 5.9.0 - Authentication Bypass via Disqus OAuth provider (CVSS 9.8, claudeschlesser Social Login)
- [CVE-2024-10216](https://cve.now/CVE-2024-10216.md): WP User Manager – User Profile Builder & Membership \<= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal (CVSS 4.3, wpusermanager WP User Manager – User Profile Builder & Memb…)
- [CVE-2024-11463](https://cve.now/CVE-2024-11463.md): DeBounce Email Validator \<= 5.6.5 - Reflected Cross-Site Scripting (CVSS 6.1, DeBounce Email Validator)
- [CVE-2024-10869](https://cve.now/CVE-2024-10869.md): GuardGiant Brute Force Protection \<= 2.2.6 - Reflected Cross-Site Scripting (CVSS 6.1, guardgiant WordPress Brute Force Protection – Stop Brute Fo…)
- [CVE-2024-11586](https://cve.now/CVE-2024-11586.md): Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected. (CVSS 4.0, Canonical Ubuntu's pulseaudio)
- [CVE-2024-41761](https://cve.now/CVE-2024-41761.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.