# CVEs published 2024-12-09

286 CVEs were published on December 9, 2024: 28 critical, 34 high. Days are UTC.

- [CVE-2024-9672](https://cve.now/CVE-2024-9672.md): Reflected XSS in PaperCut MF (CVSS 6.3, PaperCut MF)
- [CVE-2024-55638](https://cve.now/CVE-2024-55638.md): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008 (CVSS 9.8, Drupal Core · drupal/core +2)
- [CVE-2024-55637](https://cve.now/CVE-2024-55637.md): Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 (CVSS 9.8, Drupal Core · drupal/core +2)
- [CVE-2024-55636](https://cve.now/CVE-2024-55636.md): Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 (CVSS 9.8, Drupal Core · drupal/core +2)
- [CVE-2024-55635](https://cve.now/CVE-2024-55635.md): Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005 (CVSS 6.1, Drupal Core)
- [CVE-2024-55634](https://cve.now/CVE-2024-55634.md): Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 (CVSS 8.1, Drupal Core · drupal/core +2)
- [CVE-2024-12393](https://cve.now/CVE-2024-12393.md): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 (CVSS 5.4, Drupal Core · drupal/core +2)
- [CVE-2024-12174](https://cve.now/CVE-2024-12174.md): An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could interce (CVSS 2.7, Tenable Security Center)
- [CVE-2024-55601](https://cve.now/CVE-2024-55601.md): Hugo does not escape some attributes in internal templates (CVSS 5.3, gohugoio hugo · github.com/gohugoio/hugo)
- [CVE-2024-54151](https://cve.now/CVE-2024-54151.md): Directus allows unauthenticated access to WebSocket events and operations (CVSS 7.5, directus · @directus/api)
- [CVE-2024-54149](https://cve.now/CVE-2024-54149.md): Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion (CVSS 8.5, wintercms winter · winter/wn-cms-module)
- [CVE-2024-12369](https://cve.now/CVE-2024-12369.md): Elytron-oidc-client: oidc authorization code injection (CVSS 4.2, wildfly · Red Hat JBoss Enterprise Application Platform +3)
- [CVE-2024-12057](https://cve.now/CVE-2024-12057.md): User credentials recorded in log files (CVSS 1.8, arcinfo PcVue)
- [CVE-2024-54147](https://cve.now/CVE-2024-54147.md): Altair GraphQL Client's desktop app does not validate HTTPS certificates (CVSS 6.8, altair-graphql altair)
- [CVE-2024-53847](https://cve.now/CVE-2024-53847.md): Trix vulnerable to Cross-site Scripting on copy & paste (CVSS 5.1, basecamp trix · trix)
- [CVE-2024-52599](https://cve.now/CVE-2024-52599.md): Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin (CVSS 5.4, Enalean tuleap)
- [CVE-2024-52586](https://cve.now/CVE-2024-52586.md): eLabFTW MFA bypass (CVSS 5.4, elabftw)
- [CVE-2024-11608](https://cve.now/CVE-2024-11608.md): A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. (CVSS 7.8, Autodesk Revit)
- [CVE-2024-11454](https://cve.now/CVE-2024-11454.md): Untrusted Search Path vulnerability in Autodesk Revit (CVSS 7.8, Autodesk Revit)
- [CVE-2024-11268](https://cve.now/CVE-2024-11268.md): PDF File Parsing Vulnerability in Autodesk Revit (CVSS 5.5, Autodesk Revit)
- [CVE-2024-45760](https://cve.now/CVE-2024-45760.md): Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. (CVSS 4.3, Dell OpenManage Server Administrator)
- [CVE-2024-45761](https://cve.now/CVE-2024-45761.md): Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. (CVSS 5.4, Dell OpenManage Server Administrator)
- [CVE-2023-7298](https://cve.now/CVE-2023-7298.md): Out-of-Bounds Write Vulnerability in in Autodesk Desktop Software (CVSS 4.4, Autodesk FBX SDK)
- [CVE-2024-49600](https://cve.now/CVE-2024-49600.md): Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. (CVSS 7.8, Dell Power Manager)
- [CVE-2024-38485](https://cve.now/CVE-2024-38485.md): Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. (CVSS 4.3, Dell ECS)
- [CVE-2024-42426](https://cve.now/CVE-2024-42426.md): Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2024-11991](https://cve.now/CVE-2024-11991.md): Uninitialized memory access in Motoko incremental garbage collector (CVSS 5.6, Internet Computer Motoko)
- [CVE-2024-49603](https://cve.now/CVE-2024-49603.md): Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2024-49602](https://cve.now/CVE-2024-49602.md): Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2024-53949](https://cve.now/CVE-2024-53949.md): Apache Superset: Lower privilege users are able to create Role when FAB\_ADD\_SECURITY\_API is enabled (CVSS 7.6, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-53948](https://cve.now/CVE-2024-53948.md): Apache Superset: Error verbosity exposes metadata in analytics databases (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-53947](https://cve.now/CVE-2024-53947.md): Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (CVSS 2.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-8259](https://cve.now/CVE-2024-8259.md): Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program (CVSS 9.8, Eryaz Information Technologies NatraCar B2B Dealer Manageme…)
- [CVE-2023-41953](https://cve.now/CVE-2023-41953.md): WordPress ProfilePress plugin \<= 4.13.1 - Broken Access Control vulnerability (CVSS 5.3, ProfilePress Membership Team ProfilePress)
- [CVE-2024-53814](https://cve.now/CVE-2024-53814.md): WordPress Analytify plugin \<= 5.4.3 - Broken Access Control vulnerability (CVSS 6.5, Adnan Analytify)
- [CVE-2024-54218](https://cve.now/CVE-2024-54218.md): WordPress AIO Contact plugin \<= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5, thehp AIO Contact)
- [CVE-2024-52385](https://cve.now/CVE-2024-52385.md): WordPress Team Member – Multi Language Supported Team plugin \<= 7.4 - Limited Local File Inclusion vulnerability (CVSS 4.3, wpmart Team Member)
- [CVE-2024-52391](https://cve.now/CVE-2024-52391.md): WordPress Pie Register Premium plugin \< 3.8.3.3 - Broken Access Control vulnerability (CVSS 5.3, Genetech Pie Register Premium)
- [CVE-2024-52480](https://cve.now/CVE-2024-52480.md): WordPress Jobify plugin \< 4.3.0 - Broken Access Control vulnerability (CVSS 5.3, Astoundify Jobify)
- [CVE-2024-53785](https://cve.now/CVE-2024-53785.md): WordPress Chatter plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 4.3, Alexander Volkov Chatter)
- [CVE-2024-53816](https://cve.now/CVE-2024-53816.md): WordPress Tutor LMS Elementor Addons plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 4.3, Themeum Tutor LMS Elementor Addons)
- [CVE-2024-54217](https://cve.now/CVE-2024-54217.md): WordPress ARForms plugin \<= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability (CVSS 5.4, reputeinfosystems ARForms)
- [CVE-2024-53791](https://cve.now/CVE-2024-53791.md): WordPress Lenxel Core plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ogun Labs Lenxel Core for Lenxel(LNX) LMS)
- [CVE-2024-53798](https://cve.now/CVE-2024-53798.md): WordPress FloristPress plugin \<= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability (CVSS 5.4, BAKKBONE Australia FloristPress)
- [CVE-2024-53818](https://cve.now/CVE-2024-53818.md): WordPress PostX plugin \<= 4.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPXPO PostX)
- [CVE-2024-54219](https://cve.now/CVE-2024-54219.md): WordPress AIO Contact plugin \<= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thehp AIO Contact)
- [CVE-2024-54220](https://cve.now/CVE-2024-54220.md): WordPress FAT Services Booking plugin \<= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability (CVSS 7.1, roninwp FAT Services Booking)
- [CVE-2024-54247](https://cve.now/CVE-2024-54247.md): WordPress ABCBiz Addons and Templates for Elementor plugin \<= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ABCBiz Addons and Templates for Elementor)
- [CVE-2024-54253](https://cve.now/CVE-2024-54253.md): WordPress Xpro Addons For Elementor plugin \<= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xpro Elementor Addons)
- [CVE-2024-54254](https://cve.now/CVE-2024-54254.md): WordPress Message Filter for Contact Form 7 plugin \<= 1.6.3 - Broken Access Control vulnerability (CVSS 6.3, Kofi Mokome Message Filter for Contact Form)
- [CVE-2024-53819](https://cve.now/CVE-2024-53819.md): WordPress Client Invoicing by Sprout Invoices plugin \<= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, BoldGrid Client Invoicing by Sprout Invoices)
- [CVE-2024-54215](https://cve.now/CVE-2024-54215.md): WordPress Revy plugin \<= 1.18 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, roninwp Revy)
- [CVE-2024-53822](https://cve.now/CVE-2024-53822.md): WordPress Pie Register Premium plugin \< 3.8.3.3 - Arbitrary File Upload vulnerability (CVSS 10.0, Genetech Pie Register Premium)
- [CVE-2024-53790](https://cve.now/CVE-2024-53790.md): WordPress Lenxel Core plugin \<= 1.2.8 - Local File Inclusion vulnerability (CVSS 7.5, Ogun Labs Lenxel Core for Lenxel(LNX) LMS)
- [CVE-2024-43222](https://cve.now/CVE-2024-43222.md): WordPress Sweet Date theme \<= 3.7.3 - Privilege Escalation vulnerability (CVSS 9.8, SeventhQueen Sweet Date)
- [CVE-2023-48277](https://cve.now/CVE-2023-48277.md): WordPress Super Progressive Web Apps plugin \<= 2.2.21 - Broken Access Control vulnerability (CVSS 4.3, SuperPWA Super Progressive Web Apps)
- [CVE-2024-54227](https://cve.now/CVE-2024-54227.md): WordPress Minimum and Maximum Quantity for WooCommerce plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 4.3, Dotstore Minimum and Maximum Quantity for WooCommerce)
- [CVE-2024-54251](https://cve.now/CVE-2024-54251.md): WordPress Prodigy Commerce plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 6.5, prodigycommerce Prodigy Commerce)
- [CVE-2024-54224](https://cve.now/CVE-2024-54224.md): WordPress ElementsReady Addons for Elementor plugin \<= 6.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-54228](https://cve.now/CVE-2024-54228.md): WordPress Wot Elementor Widgets plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Weboccult Technologies Pvt Wot Elementor Widgets)
- [CVE-2024-54230](https://cve.now/CVE-2024-54230.md): WordPress Unlock Addons for Elementor plugin \<= 2.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Masud Hasan Unlock Addons for Elementor)
- [CVE-2024-54232](https://cve.now/CVE-2024-54232.md): WordPress RRAddons for Elementor plugin \<= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RRDevs RRAddons for Elementor)
- [CVE-2024-54260](https://cve.now/CVE-2024-54260.md): WordPress News Kit Elementor Addons plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, blazethemes News Kit Elementor Addons)
- [CVE-2024-54226](https://cve.now/CVE-2024-54226.md): WordPress Country Blocker plugin \<= 3.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, karlkiesinger Country Blocker)
- [CVE-2024-54255](https://cve.now/CVE-2024-54255.md): WordPress Login Widget With Shortcode plugin \<= 6.1.2 - Open Redirection vulnerability (CVSS 4.7, aviplugins.com Login Widget With Shortcode)
- [CVE-2024-54225](https://cve.now/CVE-2024-54225.md): WordPress Designer plugin \<= 1.4.1 - Local File Inclusion vulnerability (CVSS 7.5, codegearthemes Designer)
- [CVE-2024-54223](https://cve.now/CVE-2024-54223.md): WordPress ARForms plugin \<= 1.7.1 - HTML Injection vulnerability (CVSS 5.3, reputeinfosystems ARForms Form Builder)
- [CVE-2023-22701](https://cve.now/CVE-2023-22701.md): WordPress Ebook Store plugin \<= 5.775 - Broken Authentication vulnerability (CVSS 7.5, Shopfiles Ebook Store)
- [CVE-2023-22708](https://cve.now/CVE-2023-22708.md): WordPress Kraken.io Image Optimizer plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 4.3, Karim Salman Kraken.io Image Optimizer)
- [CVE-2023-23715](https://cve.now/CVE-2023-23715.md): WordPress JobBoardWP – Job Board Listings and Submissions plugin \<= 1.2.2 - IDOR Leading To Job Removal Vulnerability (CVSS 5.2, JobBoardWP – Job Board Listings and Submissions)
- [CVE-2023-23716](https://cve.now/CVE-2023-23716.md): WordPress Zendesk Support for WordPress plugin \<= 1.8.4 - Broken Access Control vulnerability (CVSS 4.3, Zendesk Support for WordPress)
- [CVE-2023-23725](https://cve.now/CVE-2023-23725.md): WordPress Shortcodes by Angie Makes plugin \<= 3.46 - Broken Access Control vulnerability (CVSS 4.3, Chris Baldelomar Shortcodes)
- [CVE-2023-23726](https://cve.now/CVE-2023-23726.md): WordPress Tickera – WordPress Event Ticketing plugin \<= 3.5.1.0 - CSRF Leading To Post Status Change Vulnerability (CVSS 5.4, Tickera.com Tickera)
- [CVE-2023-23814](https://cve.now/CVE-2023-23814.md): WordPress Calendar Event Multi View plugin \<= 1.4.13 - Broken Access Control vulnerability (CVSS 3.8, CodePeople CP Multi View Event Calendar)
- [CVE-2023-23823](https://cve.now/CVE-2023-23823.md): WordPress Enhanced Text Widget plugin \<= 1.5.8 - Broken Access Control vulnerability (CVSS 4.3, Clever Widgets Enhanced Text Widget)
- [CVE-2023-23825](https://cve.now/CVE-2023-23825.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Broken Access Control + CSRF on Import\_WPforms vulnerability (CVSS 3.1, Brainstorm Force Spectra)
- [CVE-2023-23834](https://cve.now/CVE-2023-23834.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Broken Access Control + CSRF on Activate\_Plugin vulnerability (CVSS 4.3, Brainstorm Force Spectra)
- [CVE-2023-23868](https://cve.now/CVE-2023-23868.md): WordPress Cost of Goods for WooCommerce plugin \<= 2.8.6 - Broken Access Control vulnerability (CVSS 5.4, WPFactory Cost of Goods for WooCommerce)
- [CVE-2023-23886](https://cve.now/CVE-2023-23886.md): WordPress WP-RecentComments plugin \<= 2.2.7 - Broken Access Control vulnerability (CVSS 5.4, mg12 WP-RecentComments)
- [CVE-2023-23887](https://cve.now/CVE-2023-23887.md): WordPress Easy Google Analytics for WordPress plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 5.3, Shaon Easy Google Analytics for WordPress)
- [CVE-2023-23893](https://cve.now/CVE-2023-23893.md): WordPress Simple Giveaways plugin \<= 2.48.0 - Broken Access Control vulnerability (CVSS 5.3, Igor Benic Simple Giveaways)
- [CVE-2023-23895](https://cve.now/CVE-2023-23895.md): WordPress WP Time Slots Booking Form plugin \<= 1.1.82 - Broken Access Control vulnerability (CVSS 4.7, CodePeople WP Time Slots Booking Form)
- [CVE-2023-23975](https://cve.now/CVE-2023-23975.md): WordPress Quick Event Manager plugin \<= 9.7.4 - Broken Access Control vulnerability (CVSS 5.3, Fullworks Quick Event Manager)
- [CVE-2023-23986](https://cve.now/CVE-2023-23986.md): WordPress Reviews and Rating – Google My Business plugin \<= 4.14 - Broken Access Control vulnerability (CVSS 5.4, Noah Hearle, Design Extreme Reviews and Rating – Google My…)
- [CVE-2023-24375](https://cve.now/CVE-2023-24375.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.5.14 - Broken Access Control vulnerability (CVSS 3.5, miniOrange WordPress Social Login and Register)
- [CVE-2023-24407](https://cve.now/CVE-2023-24407.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 5.0, WpDevArt Booking calendar, Appointment Booking System)
- [CVE-2023-25026](https://cve.now/CVE-2023-25026.md): WordPress PayPal Brasil para WooCommerce plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 4.3, PayPal Brasil para WooCommerce)
- [CVE-2023-25035](https://cve.now/CVE-2023-25035.md): WordPress Quick Contact Form plugin \<= 8.0.3.1 - Broken Access Control vulnerability (CVSS 6.5, Fullworks Quick Contact Form)
- [CVE-2023-25037](https://cve.now/CVE-2023-25037.md): WordPress Booking Calendar Contact Form plugin \<= 1.2.34 - Broken Access Control vulnerability (CVSS 4.3, CodePeople Booking Calendar Contact Form)
- [CVE-2023-25048](https://cve.now/CVE-2023-25048.md): WordPress Fantastic Content Protector Free plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 5.3, Fantastic Plugins Fantastic Content Protector Free)
- [CVE-2023-25060](https://cve.now/CVE-2023-25060.md): WordPress Album and Image Gallery plus Lightbox plugin \<= 1.6.2 - Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Album and Image Gallery…)
- [CVE-2023-25067](https://cve.now/CVE-2023-25067.md): WordPress We’re Open! plugin \<= 1.45 - Broken Access Control vulnerability (CVSS 4.3, Noah Hearle, Design Extreme We’re Open!)
- [CVE-2023-25454](https://cve.now/CVE-2023-25454.md): WordPress Protected Posts Logout Button plugin \<= 1.4.5 - Broken Access Control vulnerability (CVSS 6.5, Nate Reist Protected Posts Logout Button)
- [CVE-2023-25455](https://cve.now/CVE-2023-25455.md): WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin \<= 7.6.0 - Arbitrary Content Deletion vulnerability (CVSS 5.3, miniOrange WordPress Social Login and Register)
- [CVE-2023-25469](https://cve.now/CVE-2023-25469.md): WordPress Easy Table of Contents plugin \<= 2.0.45.2 - Broken Access Control vulnerability (CVSS 5.4, Magazine3 Easy Table of Contents)
- [CVE-2023-25486](https://cve.now/CVE-2023-25486.md): WordPress Clone plugin \<= 2.3.7 - Broken Access Control vulnerability (CVSS 4.3, Migrate Clone)
- [CVE-2023-25703](https://cve.now/CVE-2023-25703.md): WordPress Meta slider and carousel with lightbox plugin \<= 1.6.2 - Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Meta slider and carousel…)
- [CVE-2023-25714](https://cve.now/CVE-2023-25714.md): WordPress Quick Paypal Payments plugin \<= 5.7.25 - Broken Access Control vulnerability (CVSS 7.5, Fullworks Quick Paypal Payments)
- [CVE-2023-25791](https://cve.now/CVE-2023-25791.md): WordPress Fontiran plugin \<= 2.1 - Broken Access Control vulnerability (CVSS 5.4, Cadus Pro Fontiran)
- [CVE-2023-25959](https://cve.now/CVE-2023-25959.md): WordPress Apollo13 Framework Extensions plugin \<= 1.8.10 - Broken Access Control (CVSS 5.4, Apollo13Themes Apollo13 Framework Extensions)
- [CVE-2023-25966](https://cve.now/CVE-2023-25966.md): WordPress FileBird plugin \<= 5.1.4 - Broken Access Control vulnerability (CVSS 5.5, Ninja Team Filebird)
- [CVE-2023-25993](https://cve.now/CVE-2023-25993.md): WordPress Top 10 – Popular posts plugin for WordPress plugin \<= 3.2.3 - Broken Access Control vulnerability (CVSS 4.3, WebberZone Top)
- [CVE-2023-26520](https://cve.now/CVE-2023-26520.md): WordPress Advanced Text Widget plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 5.3, Max Chirkov Advanced Text Widget)
- [CVE-2023-26522](https://cve.now/CVE-2023-26522.md): WordPress WP Repost plugin \<= 0.1 - Broken Access Control vulnerability (CVSS 6.5, OneWebsite WP Repost)
- [CVE-2023-27428](https://cve.now/CVE-2023-27428.md): WordPress WP users media plugin \<= 4.2.3 - Broken Access Control vulnerability (CVSS 5.4, Damir Calusic WP users media)
- [CVE-2023-27449](https://cve.now/CVE-2023-27449.md): WordPress Total Poll Lite plugin \<= 4.8.6 - Broken Access Control vulnerability (CVSS 6.3, TotalSuite Total Poll Lite)
- [CVE-2023-27454](https://cve.now/CVE-2023-27454.md): WordPress Rife Elementor Extensions & Templates plugin \<= 1.1.10 - Broken Access Control vulnerability (CVSS 5.4, Apollo13Themes Rife Elementor Extensions & Templates)
- [CVE-2023-27625](https://cve.now/CVE-2023-27625.md): WordPress Site Reviews plugin \<= 6.5.0 - Broken Access Control vulnerability (CVSS 4.3, Paul Ryley Site Reviews)
- [CVE-2023-27626](https://cve.now/CVE-2023-27626.md): WordPress Stock Ticker plugin \<= 3.23.0 - Broken Access Control vulnerability (CVSS 5.3, Aleksandar Urošević Stock Ticker)
- [CVE-2023-28165](https://cve.now/CVE-2023-28165.md): WordPress Backup Bank: WordPress Backup Plugin plugin \<= 4.0.28 - Broken Access Control vulnerability (CVSS 4.3, Tech Banker Backup Bank: WordPress Backup Plugin)
- [CVE-2023-28168](https://cve.now/CVE-2023-28168.md): WordPress WordPress Console plugin \<= 0.3.9 - Broken Access Control vulnerability (CVSS 3.7, Jerod Santo WordPress Console)
- [CVE-2023-28416](https://cve.now/CVE-2023-28416.md): WordPress Chankhe theme \<= 1.0.5 - Authenticated Arbitrary Plugin Activation vulnerability (CVSS 4.3, Sparkle Themes Chankhe)
- [CVE-2023-28417](https://cve.now/CVE-2023-28417.md): WordPress Dynamics 365 Integration plugin \<= 1.3.12 - Broken Access Control vulnerability (CVSS 5.4, AlexaCRM Dynamics 365 Integration)
- [CVE-2023-28532](https://cve.now/CVE-2023-28532.md): WordPress Real Estate Directory theme \<= 1.0.5 - Authenticated Arbitrary Plugin Activation (CVSS 4.3, wpdirectorykit.com Real Estate Directory)
- [CVE-2023-28536](https://cve.now/CVE-2023-28536.md): WordPress Branded Social Images plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, Acato Branded Social Images)
- [CVE-2023-28688](https://cve.now/CVE-2023-28688.md): WordPress TH Variation Swatches plugin \<= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4, ThemeHunk TH Variation Swatches)
- [CVE-2023-28689](https://cve.now/CVE-2023-28689.md): WordPress JS Job Manager plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 6.5, JoomSky JS Job Manager)
- [CVE-2023-29173](https://cve.now/CVE-2023-29173.md): WordPress Product Category Tree plugin \<= 2.5 - Broken Access Control vulnerability (CVSS 5.3, AWESOME TOGI Product Category Tree)
- [CVE-2023-29237](https://cve.now/CVE-2023-29237.md): WordPress Remove Duplicate Posts plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 6.3, Muhammad Rehman Remove Duplicate Posts)
- [CVE-2023-29239](https://cve.now/CVE-2023-29239.md): WordPress LuckyWP Scripts Control plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 5.4, LuckyWP Scripts Control)
- [CVE-2023-29422](https://cve.now/CVE-2023-29422.md): WordPress Dynamics 365 Integration plugin \<= 1.3.13 - Broken Access Control vulnerability (CVSS 4.3, AlexaCRM Dynamics 365 Integration)
- [CVE-2023-29429](https://cve.now/CVE-2023-29429.md): WordPress User Registration plugin \<= 2.3.2.1 - Broken Access Control vulnerability (CVSS 5.3, WPEverest User Registration)
- [CVE-2023-29431](https://cve.now/CVE-2023-29431.md): WordPress qTranslate X Cleanup and WPML Import plugin \<= 3.0.1 - Broken Access Control vulnerability (CVSS 4.3, OntheGoSystems qTranslate X Cleanup and WPML Import)
- [CVE-2023-29433](https://cve.now/CVE-2023-29433.md): WordPress tencentcloud-cos plugin \<= 1.0.7 - Broken Access Control vulnerability (CVSS 5.4, 腾讯云 tencentcloud-cos)
- [CVE-2023-30476](https://cve.now/CVE-2023-30476.md): WordPress Blogger Buzz theme \<= 1.2.2 - Broken Access Control vulnerability (CVSS 4.3, Sparkle Themes Blogger Buzz)
- [CVE-2023-30479](https://cve.now/CVE-2023-30479.md): WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin \<= 2.3.2 - Broken Access Control vulnerability (CVSS 5.3, Stamped.io Product Reviews & UGC for WooCommerce)
- [CVE-2023-30486](https://cve.now/CVE-2023-30486.md): WordPress Square theme \<= 2.0.0 - Broken Access Control (CVSS 4.3, HashThemes Square)
- [CVE-2023-30488](https://cve.now/CVE-2023-30488.md): WordPress Featured Post Creative plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Featured Post Creative)
- [CVE-2023-30748](https://cve.now/CVE-2023-30748.md): WordPress Easy Appointments plugin \<= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.3, Nikola Loncar Easy Appointments)
- [CVE-2023-30783](https://cve.now/CVE-2023-30783.md): WordPress Smart WooCommerce Search plugin \<= 2.5.0 - Broken Access Control (CVSS 4.3, YummyWP Smart WooCommerce Search)
- [CVE-2023-30870](https://cve.now/CVE-2023-30870.md): WordPress Sharkdropship for AliExpress Dropship and Affiliate plugin \<= 2.2.3 - Multiple Broken Access Control vulnerabilities (CVSS 6.5, wooproductimporter Sharkdropship for AliExpress Dropship an…)
- [CVE-2023-30873](https://cve.now/CVE-2023-30873.md): WordPress WP Docs plugin \<= 1.9.8 - Broken Access Control (CVSS 5.4, Fahad Mahmood WP Docs)
- [CVE-2023-31073](https://cve.now/CVE-2023-31073.md): WordPress Shortcode to display post and user data plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3, Jose Vega Display custom fields in the frontend – Post and…)
- [CVE-2023-31214](https://cve.now/CVE-2023-31214.md): WordPress WP Quick Post Duplicator plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 5.4, Arul Prasad J WP Quick Post Duplicator)
- [CVE-2023-32094](https://cve.now/CVE-2023-32094.md): WordPress Extended Post Status plugin \<= 1.0.19 - Broken Access Control vulnerability (CVSS 5.4, Felix Welberg Extended Post Status)
- [CVE-2023-32117](https://cve.now/CVE-2023-32117.md): WordPress Integrate Google Drive plugin \<= 1.1.99 - Unauthenticated Broken Access Control vulnerability (CVSS 9.8, SoftLab Integrate Google Drive)
- [CVE-2023-32126](https://cve.now/CVE-2023-32126.md): WordPress SALERT plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3, WPoperation SALERT)
- [CVE-2023-32293](https://cve.now/CVE-2023-32293.md): WordPress WRC Pricing Tables plugin \<= 2.3.7 - Broken Access Control vulnerability (CVSS 5.3, Realwebcare WRC Pricing Tables)
- [CVE-2023-32299](https://cve.now/CVE-2023-32299.md): WordPress Ni WooCommerce Sales Report plugin \<= 3.7.3 - Broken Access Control vulnerability (CVSS 6.5, Anzar Ahmed Ni WooCommerce Sales Report)
- [CVE-2023-47694](https://cve.now/CVE-2023-47694.md): WordPress Mini Cart Drawer For WooCommerce plugin \<= 4.0.0 - Broken Access Control vulnerability (CVSS 5.4, appsbd Mini Cart Drawer For WooCommerce)
- [CVE-2023-47698](https://cve.now/CVE-2023-47698.md): WordPress Japanized For WooCommerce plugin \<= 2.6.4 - Multiple Broken Access Control vulnerability (CVSS 8.6, shohei.tanaka Japanized For WooCommerce)
- [CVE-2023-47756](https://cve.now/CVE-2023-47756.md): WordPress Welcome Email Editor plugin \<= 5.0.6 - Broken Access Control vulnerability (CVSS 4.3, David Vongries Welcome Email Editor)
- [CVE-2023-47760](https://cve.now/CVE-2023-47760.md): WordPress Essential Blocks plugin \<= 4.2.0 - Broken Access Control vulnerability (CVSS 4.3, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2023-47761](https://cve.now/CVE-2023-47761.md): WordPress Simple 301 Redirects by BetterLinks plugin \<= 2.0.7 - Broken Access Control vulnerability (CVSS 4.3, WPDeveloper Simple 301 Redirects by BetterLinks)
- [CVE-2023-47762](https://cve.now/CVE-2023-47762.md): WordPress BetterDocs plugin \<= 2.5.2 - Broken Access Control vulnerability (CVSS 4.3, WPDeveloper BetterDocs)
- [CVE-2023-47763](https://cve.now/CVE-2023-47763.md): WordPress WP Custom Admin Interface plugin \<= 7.31 - Broken Access Control vulnerability (CVSS 4.3, Northern Beaches Websites WP Custom Admin Interface)
- [CVE-2023-47764](https://cve.now/CVE-2023-47764.md): WordPress Ditty plugin \<= 3.1.24 - Broken Access Control vulnerability (CVSS 6.5, metaphorcreations Ditty)
- [CVE-2023-47776](https://cve.now/CVE-2023-47776.md): WordPress miniorange otp verification plugin \<= 4.2.1 - Broken Access Control vulnerability (CVSS 4.3, miniorange otp verification)
- [CVE-2023-47780](https://cve.now/CVE-2023-47780.md): WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin \<= 5.1.0 - Broken Access Control vulnerability (CVSS 4.3, flowdee EasyAzon)
- [CVE-2023-47793](https://cve.now/CVE-2023-47793.md): WordPress Acme Fix Images plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 4.3, Acme Themes Acme Fix Images)
- [CVE-2023-47805](https://cve.now/CVE-2023-47805.md): WordPress WPCafe plugin \<= 2.2.22 - Broken Access Control vulnerability (CVSS 5.3, Arraytics WPCafe)
- [CVE-2023-47820](https://cve.now/CVE-2023-47820.md): WordPress WP Like Button plugin \<= 1.7.0 - Broken Access Control vulnerability (CVSS 4.3, CRUDLab WP Like Button)
- [CVE-2023-47822](https://cve.now/CVE-2023-47822.md): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin \<= 4.10 - Broken Access Control vulnerability (CVSS 5.4, Sonaar Music MP3 Audio Player for Music, Radio & Podcast by…)
- [CVE-2023-47823](https://cve.now/CVE-2023-47823.md): WordPress FormCraft – Contact Form Builder for WordPress plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 5.3, nCrafts FormCraft)
- [CVE-2023-47826](https://cve.now/CVE-2023-47826.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.3 - Broken Access Control vulnerability (CVSS 6.5, NicheAddons Restaurant & Cafe Addon for Elementor)
- [CVE-2023-47830](https://cve.now/CVE-2023-47830.md): WordPress Live Preview for Contact Form 7 plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 5.4, Addons for Contact Form 7 Live Preview for Contact Form)
- [CVE-2023-47832](https://cve.now/CVE-2023-47832.md): WordPress SearchIQ plugin \<= 4.4 - Broken Access Control vulnerability (CVSS 5.3, SearchIQ)
- [CVE-2023-47836](https://cve.now/CVE-2023-47836.md): WordPress WP Meta and Date Remover plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 5.4, prasadkirpekar WP Meta and Date Remover)
- [CVE-2023-47838](https://cve.now/CVE-2023-47838.md): WordPress Conditional Fields for Contact Form 7 plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 4.3, Jules Colle Conditional Fields for Contact Form)
- [CVE-2023-47841](https://cve.now/CVE-2023-47841.md): WordPress Analytify plugin \<= 5.1.1 - Broken Access Control vulnerability (CVSS 4.3, Analytify)
- [CVE-2023-47847](https://cve.now/CVE-2023-47847.md): WordPress PayTR Taksit Tablosu plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 5.3, PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş. PayTR Taksit T…)
- [CVE-2023-47849](https://cve.now/CVE-2023-47849.md): WordPress BlossomThemes Email Newsletter plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 4.3, Blossom Themes BlossomThemes Email Newsletter)
- [CVE-2023-47869](https://cve.now/CVE-2023-47869.md): WordPress wpForo plugin \<= 2.2.5 - Broken Access Control + CSRF vulnerability (CVSS 4.3, gVectors Team wpForo Forum)
- [CVE-2023-47871](https://cve.now/CVE-2023-47871.md): WordPress Contact Form to Any API plugin \<= 1.1.6 - Broken Access Control vulnerability (CVSS 4.3, IT Path Solutions Contact Form to Any API)
- [CVE-2023-48274](https://cve.now/CVE-2023-48274.md): WordPress WCMultiShipping plugin \<= 2.3.5 - Broken Access Control vulnerability (CVSS 6.5, Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping)
- [CVE-2023-48286](https://cve.now/CVE-2023-48286.md): WordPress Accept Stripe Payments plugin \<= 2.0.79 - Broken Access Control vulnerability (CVSS 8.2, mra13 Stripe Payments)
- [CVE-2023-48287](https://cve.now/CVE-2023-48287.md): WordPress TextMe SMS plugin \<= 1.9.0 - Broken Access Control vulnerability (CVSS 5.4, Matat Technologies TextMe SMS)
- [CVE-2023-48324](https://cve.now/CVE-2023-48324.md): WordPress Awesome Support HelpDesk plugin \<= 6.1.4 - Broken Access control vulnerability (CVSS 5.4, awesomesupport Awesome Support)
- [CVE-2023-48332](https://cve.now/CVE-2023-48332.md): WordPress Mail Bank – #1 Mail SMTP Plugin for WordPress plugin \<= 4.0.14 - Broken Access Control vulnerability (CVSS 4.3, Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress)
- [CVE-2023-48740](https://cve.now/CVE-2023-48740.md): WordPress Easy Social Feed plugin \<= 6.5.1 - Broken Access Control vulnerability (CVSS 4.3, Sajid Javed Easy Social Feed)
- [CVE-2023-48750](https://cve.now/CVE-2023-48750.md): WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin \<= 2.1.10 - Broken Access Control vulnerability (CVSS 5.3, voidthemes Void Elementor Post Grid Addon for Elementor Pag…)
- [CVE-2023-48774](https://cve.now/CVE-2023-48774.md): WordPress IdeaPush plugin \< 8.58 - Broken Access Control vulnerability (CVSS 5.4, Martin Gibson IdeaPush)
- [CVE-2023-48776](https://cve.now/CVE-2023-48776.md): WordPress canvasio3D Light plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.4, virtuellwerk canvasio3D Light)
- [CVE-2023-48779](https://cve.now/CVE-2023-48779.md): WordPress 360 Javascript Viewer plugin \<= 1.7.11 - Broken Access Control vulnerability (CVSS 6.5, 3DWeb 360 Javascript Viewer)
- [CVE-2023-49154](https://cve.now/CVE-2023-49154.md): WordPress Button Generator – easily Button Builder plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3, Wow-Company Button Generator – easily Button Builder)
- [CVE-2023-49156](https://cve.now/CVE-2023-49156.md): WordPress GoDaddy Email Marketing plugin \<= 1.4.3 - Broken Access Control vulnerability (CVSS 4.3, GoDaddy Email Marketing)
- [CVE-2023-49158](https://cve.now/CVE-2023-49158.md): WordPress LadiApp plugin \<= 4.4 - Broken Access Control lead to XSS vulnerability (CVSS 7.1, Binh Nguyen LadiApp)
- [CVE-2023-49167](https://cve.now/CVE-2023-49167.md): WordPress Database for CF7 plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 6.5, code4life Database for CF7)
- [CVE-2023-49192](https://cve.now/CVE-2023-49192.md): WordPress Enhanced Text Widget plugin \<= 1.6.3 - Broken Access Control vulnerability (CVSS 5.3, cl272 Enhanced Text Widget)
- [CVE-2023-49193](https://cve.now/CVE-2023-49193.md): WordPress Grow Social plugin \<= 1.30.0 - Broken Access Control vulnerability (CVSS 5.3, NerdPress Hubbub Lite)
- [CVE-2023-49194](https://cve.now/CVE-2023-49194.md): WordPress Importify (Dropshipping WooCommerce) plugin \<= 1.0.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, Importify)
- [CVE-2023-49196](https://cve.now/CVE-2023-49196.md): WordPress Pagelayer plugin \<= 1.7.7 - Broken Access Control vulnerability (CVSS 4.3, Pagelayer Team PageLayer)
- [CVE-2023-49754](https://cve.now/CVE-2023-49754.md): WordPress Bulk Edit Post Titles plugin \<= 5.0.0 - Broken Access Control vulnerability (CVSS 4.3, Yogesh Pawar Bulk Edit Post Titles)
- [CVE-2023-49756](https://cve.now/CVE-2023-49756.md): WordPress Eventin plugin \<= 3.3.52 - Authenticated Notice Dismissal Vulnerability (CVSS 5.4, Arraytics Eventin)
- [CVE-2023-49755](https://cve.now/CVE-2023-49755.md): WordPress Elementor Timeline Widget plugin \<= 2.2 - Notice Dismissal Vulnerability (CVSS 5.4, B.M. Rafiul Alam Elementor Timeline Widget)
- [CVE-2023-49757](https://cve.now/CVE-2023-49757.md): WordPress Awesome Support plugin \<= 6.1.10 - Broken Access Control + CSRF vulnerability (CVSS 5.4, awesomesupport Awesome Support)
- [CVE-2023-49758](https://cve.now/CVE-2023-49758.md): WordPress WP Booking System plugin \<= 2.0.19.2 - Broken Access Control vulnerability (CVSS 4.3, Roland Murg WP Booking System)
- [CVE-2023-49817](https://cve.now/CVE-2023-49817.md): WordPress Flexible Woocommerce Checkout Field Editor plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 8.2, heoLixfy Flexible Woocommerce Checkout Field Editor)
- [CVE-2023-49818](https://cve.now/CVE-2023-49818.md): WordPress Webflow Pages plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 5.3, Webflow Pages)
- [CVE-2023-49861](https://cve.now/CVE-2023-49861.md): WordPress Social Media Feather plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 4.3, socialmediafeather Social Media Feather)
- [CVE-2023-49831](https://cve.now/CVE-2023-49831.md): WordPress RegistrationMagic plugin \<= 5.2.3.0 - Broken Access Control vulnerability (CVSS 7.5, Metagauss RegistrationMagic)
- [CVE-2023-49832](https://cve.now/CVE-2023-49832.md): WordPress Site Reviews plugin \<= 6.10.2 - Broken Access Control vulnerability (CVSS 5.3, Gemini Labs Site Reviews)
- [CVE-2023-49859](https://cve.now/CVE-2023-49859.md): WordPress Login With Ajax plugin \<= 4.1 - Broken Access Control vulnerability (CVSS 4.3, Marcus (aka @msykes) Login With Ajax)
- [CVE-2023-49835](https://cve.now/CVE-2023-49835.md): WordPress Post Duplicator plugin \<= 2.31 - Broken Access Control vulnerability (CVSS 4.3, Metaphor Creations Post Duplicator)
- [CVE-2023-49858](https://cve.now/CVE-2023-49858.md): WordPress Custom Login plugin \<= 4.1.0 - Broken Access Control vulnerability (CVSS 4.3, Austin Custom Login)
- [CVE-2023-49848](https://cve.now/CVE-2023-49848.md): WordPress Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 6.5, Marc dooder Sharkdropship dropshipping for Aliexpress, eBay…)
- [CVE-2023-49849](https://cve.now/CVE-2023-49849.md): WordPress Shortcoder plugin \<= 6.3 - Broken Access Control vulnerability (CVSS 4.3, vaakash Shortcoder)
- [CVE-2023-49850](https://cve.now/CVE-2023-49850.md): WordPress WP Simple HTML Sitemap plugin \<= 2.7 - Broken Access Control vulnerability (CVSS 5.3, Ashish Ajani WP Simple HTML Sitemap)
- [CVE-2023-49851](https://cve.now/CVE-2023-49851.md): WordPress Square Thumbnails plugin \<= 1.1.1 - Broken Access Control + CSRF vulnerability (CVSS 5.3, ILMDESIGNS Square Thumbnails)
- [CVE-2023-49856](https://cve.now/CVE-2023-49856.md): WordPress Smart Forms plugin \<= 2.6.84 - Authenticated Arbitrary Options Change Vulnerability (CVSS 8.1, EDGARROJAS Smart Forms)
- [CVE-2023-49857](https://cve.now/CVE-2023-49857.md): WordPress Awesome Support plugin \<= 6.1.7 - Broken Access Control vulnerability (CVSS 6.5, awesomesupport Awesome Support)
- [CVE-2023-50373](https://cve.now/CVE-2023-50373.md): WordPress Alt Manager plugin \<= 1.6.1 - Broken Access Control vulnerability (CVSS 5.3, WPSAAD Alt Manager)
- [CVE-2023-50375](https://cve.now/CVE-2023-50375.md): WordPress Translate WordPress – Google Language Translator plugin \<= 6.0.19 - Broken Access Control vulnerability (CVSS 5.3, edo888 Google Language Translator)
- [CVE-2023-50877](https://cve.now/CVE-2023-50877.md): WordPress Product Filter by WBW plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 4.3, woobewoo Product Filter by WBW)
- [CVE-2023-50876](https://cve.now/CVE-2023-50876.md): WordPress Molongui plugin \<= 4.7.3 - Broken Access Control vulnerability (CVSS 4.3, Molongui)
- [CVE-2023-50882](https://cve.now/CVE-2023-50882.md): WordPress ProfilePress plugin \<= 4.13.2 - Broken Access Control vulnerability (CVSS 5.3, properfraction ProfilePress)
- [CVE-2023-50884](https://cve.now/CVE-2023-50884.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 6.5, LA-Studio Element Kit for Elementor)
- [CVE-2023-50887](https://cve.now/CVE-2023-50887.md): WordPress User Feedback plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.3, Syed Balkhi User Feedback)
- [CVE-2023-50899](https://cve.now/CVE-2023-50899.md): WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin \<= 5.0.2 - Broken Access Control vulnerability (CVSS 5.4, Product Catalog Enquiry for WooCommerce by MultiVendorX)
- [CVE-2023-50903](https://cve.now/CVE-2023-50903.md): WordPress Metform Elementor Contact Form Builder plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3, Roxnor Metform)
- [CVE-2023-50904](https://cve.now/CVE-2023-50904.md): WordPress Poll Maker plugin \<= 4.8.0 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Poll Maker)
- [CVE-2023-51353](https://cve.now/CVE-2023-51353.md): WordPress Popup by Supsystic plugin \<= 1.10.19 - Broken Access Control vulnerability (CVSS 5.3, Popup by Supsystic)
- [CVE-2023-51355](https://cve.now/CVE-2023-51355.md): WordPress MultiVendorX plugin \<= 4.0.23 - Broken Access Control vulnerability (CVSS 8.2, MultiVendorX)
- [CVE-2023-51357](https://cve.now/CVE-2023-51357.md): WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin \<= 6.5.0 - Broken Access Control vulnerability (CVSS 5.3, Conversios.io)
- [CVE-2023-51360](https://cve.now/CVE-2023-51360.md): WordPress Essential Blocks plugin \<= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability (CVSS 6.5, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2023-51359](https://cve.now/CVE-2023-51359.md): WordPress Essential Blocks plugin \<= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability (CVSS 5.4, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2023-51362](https://cve.now/CVE-2023-51362.md): WordPress myStickyElements plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 5.3, Premio My Sticky Elements)
- [CVE-2023-49845](https://cve.now/CVE-2023-49845.md): WordPress Redirects plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 5.3, mattdeclaire Redirects)
- [CVE-2024-46901](https://cve.now/CVE-2024-46901.md): Apache Subversion: mod\_dav\_svn denial-of-service via control characters in paths (CVSS 3.1, Apache Software Foundation Apache Subversion)
- [CVE-2024-12307](https://cve.now/CVE-2024-12307.md): Function-Level Access Control Vulnerability Allows Unauthorized Modification of Student Data in Unifiedtransform (CVSS 4.3, Unifiedtransform)
- [CVE-2024-12306](https://cve.now/CVE-2024-12306.md): Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform (CVSS 4.3, Unifiedtransform)
- [CVE-2024-12305](https://cve.now/CVE-2024-12305.md): Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform (CVSS 4.3, Unifiedtransform)
- [CVE-2024-9651](https://cve.now/CVE-2024-9651.md): Contact Form Plugin by Fluent Forms \< 5.2.1 - Admin+ Stored XSS (CVSS 6.1, Fluent Forms)
- [CVE-2024-12360](https://cve.now/CVE-2024-12360.md): code-projects Online Class and Exam Scheduling System class\_update.php sql injection (CVSS 5.3, code-projects Online Class and Exam Scheduling System)
- [CVE-2024-12359](https://cve.now/CVE-2024-12359.md): code-projects Admin Dashboard vendor\_management.php cross site scripting (CVSS 5.3, code-projects Admin Dashboard)
- [CVE-2024-12358](https://cve.now/CVE-2024-12358.md): WeiYe-Jing datax-web add os command injection (CVSS 5.3, WeiYe-Jing datax-web)
- [CVE-2024-12357](https://cve.now/CVE-2024-12357.md): SourceCodester Best House Rental Management System index.php file inclusion (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2024-53285](https://cve.now/CVE-2024-53285.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53284](https://cve.now/CVE-2024-53284.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53283](https://cve.now/CVE-2024-53283.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in S (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53282](https://cve.now/CVE-2024-53282.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53281](https://cve.now/CVE-2024-53281.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53279](https://cve.now/CVE-2024-53279.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology (CVSS 5.9, Synology Router Manager)
- [CVE-2024-53280](https://cve.now/CVE-2024-53280.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functional (CVSS 5.9, Synology Router Manager)
- [CVE-2024-12355](https://cve.now/CVE-2024-12355.md): SourceCodester Phone Contact Manager System ContactBook.cpp adding input validation (CVSS 4.8, SourceCodester Phone Contact Manager System)
- [CVE-2024-12354](https://cve.now/CVE-2024-12354.md): SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflow (CVSS 4.8, SourceCodester Phone Contact Manager System)
- [CVE-2024-12353](https://cve.now/CVE-2024-12353.md): SourceCodester Phone Contact Manager System User Menu MenuDisplayStart input validation (CVSS 4.8, SourceCodester Phone Contact Manager System)
- [CVE-2024-12352](https://cve.now/CVE-2024-12352.md): TOTOLINK EX1800T cstecgi.cgi sub\_40662C stack-based overflow (CVSS 5.3, TOTOLINK EX1800T)
- [CVE-2024-12351](https://cve.now/CVE-2024-12351.md): JFinalCMS File Content ContentModel.java findPage sql injection (CVSS 5.3, JFinalCMS)
- [CVE-2024-12350](https://cve.now/CVE-2024-12350.md): JFinalCMS Template TemplateController.java update command injection (CVSS 5.3, JFinalCMS)
- [CVE-2024-12349](https://cve.now/CVE-2024-12349.md): JFinalCMS save cross-site request forgery (CVSS 6.9, JFinalCMS)
- [CVE-2024-12348](https://cve.now/CVE-2024-12348.md): Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting (CVSS 5.3, Guizhou Xiaoma Technology jpress)
- [CVE-2022-29974](https://cve.now/CVE-2022-29974.md): AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. (CVSS 4.3)
- [CVE-2022-38946](https://cve.now/CVE-2022-38946.md): Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup\_com.php, allows attackers to execute arbitrary cod (CVSS 9.8)
- [CVE-2022-38947](https://cve.now/CVE-2022-38947.md): SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product\_title parameter, allows attackers to execute arbitrary (CVSS 9.8)
- [CVE-2023-43962](https://cve.now/CVE-2023-43962.md): Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project n (CVSS 4.8)
- [CVE-2024-40582](https://cve.now/CVE-2024-40582.md): Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information. (CVSS 7.5)
- [CVE-2024-40583](https://cve.now/CVE-2024-40583.md): Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. (CVSS 9.1)
- [CVE-2024-46455](https://cve.now/CVE-2024-46455.md): unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. (CVSS 9.8, unstructured · github.com/Unstructured-IO/unstructured)
- [CVE-2024-46547](https://cve.now/CVE-2024-46547.md): A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access (CVSS 7.5)
- [CVE-2024-48956](https://cve.now/CVE-2024-48956.md): Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a (CVSS 9.8)
- [CVE-2024-50625](https://cve.now/CVE-2024-50625.md): An issue was discovered in Digi ConnectPort LTS before 1.4.12. (CVSS 8.0)
- [CVE-2024-50626](https://cve.now/CVE-2024-50626.md): An issue was discovered in Digi ConnectPort LTS before 1.4.12. (CVSS 8.8)
- [CVE-2024-50627](https://cve.now/CVE-2024-50627.md): An issue was discovered in Digi ConnectPort LTS before 1.4.12. (CVSS 8.8)
- [CVE-2024-50628](https://cve.now/CVE-2024-50628.md): An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. (CVSS 8.8)
- [CVE-2024-53441](https://cve.now/CVE-2024-53441.md): An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. (CVSS 9.1, cookie-encrypter)
- [CVE-2024-53450](https://cve.now/CVE-2024-53450.md): RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents. (CVSS 7.5)
- [CVE-2024-54918](https://cve.now/CVE-2024-54918.md): Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher\_avatar.php. (CVSS 9.8)
- [CVE-2024-54919](https://cve.now/CVE-2024-54919.md): A Stored Cross Site Scripting (XSS ) was found in /teacher\_avatar.php of kashipara E-learning Management System v1.0. (CVSS 5.4)
- [CVE-2024-54920](https://cve.now/CVE-2024-54920.md): A SQL Injection vulnerability was found in /teacher\_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers (CVSS 9.8)
- [CVE-2024-54921](https://cve.now/CVE-2024-54921.md): A SQL Injection was found in /student\_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute ar (CVSS 9.8)
- [CVE-2024-54922](https://cve.now/CVE-2024-54922.md): A SQL Injection was found in /admin/edit\_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute a (CVSS 9.8)
- [CVE-2024-54923](https://cve.now/CVE-2024-54923.md): A SQL Injection vulnerability was found in /admin/edit\_teacher.php in kashipara E-learning Management System v1.0, which allows remote attac (CVSS 9.8)
- [CVE-2024-54924](https://cve.now/CVE-2024-54924.md): A SQL Injection was found in /admin/edit\_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execut (CVSS 9.8)
- [CVE-2024-54925](https://cve.now/CVE-2024-54925.md): A SQL Injection was found in /remove\_sent\_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execu (CVSS 9.8)
- [CVE-2024-54926](https://cve.now/CVE-2024-54926.md): A SQL Injection vulnerability was found in /search\_class.php of kashipara E-learning Management System v1.0, which allows remote attackers t (CVSS 9.8)
- [CVE-2024-54927](https://cve.now/CVE-2024-54927.md): Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_users.php. (CVSS 7.2)
- [CVE-2024-54928](https://cve.now/CVE-2024-54928.md): kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_teacher.php, (CVSS 7.2)
- [CVE-2024-54929](https://cve.now/CVE-2024-54929.md): KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_subject.php. (CVSS 7.2)
- [CVE-2024-54930](https://cve.now/CVE-2024-54930.md): Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_student.php. (CVSS 9.8)
- [CVE-2024-54931](https://cve.now/CVE-2024-54931.md): A SQL Injection was found in /admin/delete\_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execut (CVSS 9.8)
- [CVE-2024-54932](https://cve.now/CVE-2024-54932.md): Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_department.php. (CVSS 9.8)
- [CVE-2024-54933](https://cve.now/CVE-2024-54933.md): Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_content.php. (CVSS 9.8)
- [CVE-2024-54934](https://cve.now/CVE-2024-54934.md): Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete\_class.php. (CVSS 9.8)
- [CVE-2024-54935](https://cve.now/CVE-2024-54935.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /send\_message\_teacher\_to\_student.php of kashipara E-learning Management Syste (CVSS 5.4)
- [CVE-2024-54936](https://cve.now/CVE-2024-54936.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /send\_message.php of Kashipara E-learning Management System v1.0. (CVSS 5.4)
- [CVE-2024-54937](https://cve.now/CVE-2024-54937.md): A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files (CVSS 5.3)
- [CVE-2024-54938](https://cve.now/CVE-2024-54938.md): A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files (CVSS 7.5)
- [CVE-2024-55563](https://cve.now/CVE-2024-55563.md): Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. (CVSS 5.3)
- [CVE-2024-55564](https://cve.now/CVE-2024-55564.md): The POSIX::2008 package before 0.24 for Perl has a potential \_execve50c env buffer overflow. (CVSS 9.8)
- [CVE-2024-55565](https://cve.now/CVE-2024-55565.md): nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. (CVSS 4.3, nanoid)
- [CVE-2024-55566](https://cve.now/CVE-2024-55566.md): ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). (CVSS 6.6)
- [CVE-2024-55578](https://cve.now/CVE-2024-55578.md): Zammad before 6.4.1 places sensitive data (such as auth\_microsoft\_office365\_credentials and application\_secret) in log files. (CVSS 4.3)
- [CVE-2024-55579](https://cve.now/CVE-2024-55579.md): An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. (CVSS 8.8)
- [CVE-2024-55580](https://cve.now/CVE-2024-55580.md): An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. (CVSS 7.5)
- [CVE-2024-55582](https://cve.now/CVE-2024-55582.md): Oxide before 6 has unencrypted Control Plane datastores. (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.