# CVEs published 2024-12-07 32 CVEs were published on December 7, 2024: 0 critical, 6 high. Days are UTC. - [CVE-2024-47107](https://cve.now/CVE-2024-47107.md): IBM QRadar SIEM cross-site scripting (CVSS 6.4, IBM QRadar SIEM) - [CVE-2024-41762](https://cve.now/CVE-2024-41762.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows) - [CVE-2024-37071](https://cve.now/CVE-2024-37071.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows) - [CVE-2024-47115](https://cve.now/CVE-2024-47115.md): IBM AIX command execution (CVSS 7.8, IBM AIX) - [CVE-2024-11457](https://cve.now/CVE-2024-11457.md): Feedpress Generator – External RSS Frontend Customizer \<= 1.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, spartac Feedpress Generator – External RSS Frontend Customi…) - [CVE-2024-11380](https://cve.now/CVE-2024-11380.md): Mini Program API \<= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, imahui Mini Program API) - [CVE-2024-11501](https://cve.now/CVE-2024-11501.md): Gallery \<= 1.3 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, webdzier Gallery) - [CVE-2024-11464](https://cve.now/CVE-2024-11464.md): Easy Code Snippets \<= 1.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, alphabposervice Easy Code Snippets) - [CVE-2024-12128](https://cve.now/CVE-2024-12128.md): Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal \<= 3.1.2 - Reflected Cross-Site Scripting via monthly\_sales\_current\_year Parameter (CVSS 6.1, nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sel…) - [CVE-2024-11010](https://cve.now/CVE-2024-11010.md): FileOrganizer \<= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion (CVSS 7.2, softaculous FileOrganizer – WordPress File Manager) - [CVE-2024-11367](https://cve.now/CVE-2024-11367.md): Smoove connector for Elementor forms \<= 4.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, matansmoove Smoove connector for Elementor forms) - [CVE-2024-12270](https://cve.now/CVE-2024-12270.md): Beautiful Taxonomy Filters \<= 2.4.3 - Unauthenticated SQL Injection (CVSS 7.5, jonathandejong Beautiful taxonomy filters) - [CVE-2024-11374](https://cve.now/CVE-2024-11374.md): TWChat – Send or receive messages from users \<= 4.0.4 - Reflected Cross-Site Scripting (CVSS 6.1, rezaplus TWChat – Send or receive messages from users) - [CVE-2024-12253](https://cve.now/CVE-2024-12253.md): Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal \<= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access (CVSS 5.4, nshowketgmailcom Simple Ecommerce Shopping Cart Plugin- Sel…) - [CVE-2024-53143](https://cve.now/CVE-2024-53143.md): fsnotify: Fix ordering of iput() and watched\_objects decrement (CVSS 7.8, Linux) - [CVE-2024-11183](https://cve.now/CVE-2024-11183.md): Simple Side Tab \< 2.2.0 - Admin+ Stored XSS (CVSS 4.8, Simple Side Tab) - [CVE-2024-7894](https://cve.now/CVE-2024-7894.md): If Menu \<= 0.19.1 - Missing Authorization to License Key Update (CVSS 5.3, andreiigna If Menu – Visibility control for Menus) - [CVE-2024-8679](https://cve.now/CVE-2024-8679.md): Library Management System \<= 3.1 - Authenticated (Admin+) SQL Injection (CVSS 6.8, owthub Library Management System) - [CVE-2024-12115](https://cve.now/CVE-2024-12115.md): Poll Maker \<= 5.5.4 - Cross-Site Request Forgery to Poll Duplication (CVSS 4.3, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…) - [CVE-2024-12167](https://cve.now/CVE-2024-12167.md): Shortcodes Blocks Creator Ultimate \<= 2.2.0 - Reflected Cross-Site Scripting via \_wpnonce (CVSS 6.1, cmorillas1 Shortcodes Blocks Creator Ultimate) - [CVE-2024-12165](https://cve.now/CVE-2024-12165.md): Mollie for Contact Form 7 \<= 5.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, tsjippy Mollie for Contact Form) - [CVE-2024-11353](https://cve.now/CVE-2024-11353.md): SMS for Lead Capture Forms \<= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (CVSS 4.3, clicksend SMS for Lead Capture Forms) - [CVE-2024-12257](https://cve.now/CVE-2024-12257.md): CardGate Payments for WooCommerce \<= 3.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, CardGate Payments for WooCommerce) - [CVE-2024-11904](https://cve.now/CVE-2024-11904.md): 코드엠샵 소셜톡 \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codemstory 코드엠샵 소셜톡) - [CVE-2024-12026](https://cve.now/CVE-2024-12026.md): Message Filter for Contact Form 7 \<= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation (CVSS 4.3, kofimokome Message Filter for Contact Form) - [CVE-2024-12166](https://cve.now/CVE-2024-12166.md): Shortcodes Blocks Creator Ultimate \<= 2.2.0 - Reflected Cross-Site Scripting via 'page' (CVSS 6.1, cmorillas1 Shortcodes Blocks Creator Ultimate) - [CVE-2024-11451](https://cve.now/CVE-2024-11451.md): Zooom \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, harshitpeer Zooom) - [CVE-2024-11943](https://cve.now/CVE-2024-11943.md): 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 \<= 5.2.2 - Reflected Cross-Site Scripting via add\_query\_arg Function (CVSS 6.1, codemstory 워드프레스 결제 심플페이 – 우커머스 결제 플러그인) - [CVE-2024-10046](https://cve.now/CVE-2024-10046.md): افزونه پیامک ووکامرس Persian WooCommerce SMS \<= 7.0.5 - Reflected Cross-Site Scripting (CVSS 6.1, persianscript افزونه پیامک ووکامرس Persian WooCommerce SMS) - [CVE-2024-11436](https://cve.now/CVE-2024-11436.md): Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! \<= 1.4.19 - Reflected Cross-Site Scripting (CVSS 6.1, genetechproducts Pie Forms — Drag & Drop Form Builder) - [CVE-2024-11329](https://cve.now/CVE-2024-11329.md): Comfino Payment Gateway \<= 4.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, Comfino Payment Gateway) - [CVE-2024-53473](https://cve.now/CVE-2024-53473.md): WeGIA 3.2.0 before 3998672 does not verify permission to change a password. (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-12-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.