# CVEs published 2024-12-13

296 CVEs were published on December 13, 2024: 19 critical, 81 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-12553](https://cve.now/CVE-2024-12553.md): GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability (CVSS 6.5, GeoVision GV-ASManager)
- [CVE-2024-12552](https://cve.now/CVE-2024-12552.md): Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability (CVSS 7.0, Wacom Center)
- [CVE-2024-55946](https://cve.now/CVE-2024-55946.md): Playloom Engine Data Storage Vulnerability (CVSS 8.7, Quetrobits Playloom-Engine)
- [CVE-2024-55890](https://cve.now/CVE-2024-55890.md): D-Tale allows Remote Code Execution through the Custom Filter Input (CVSS 6.9, man-group dtale · dtale)
- [CVE-2024-47892](https://cve.now/CVE-2024-47892.md): GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA) (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-46971](https://cve.now/CVE-2024-46971.md): GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-55887](https://cve.now/CVE-2024-55887.md): Ucum-java has an XXE vulnerability in XML parsing (CVSS 8.6, FHIR Ucum-java · org.fhir:ucum)
- [CVE-2024-55661](https://cve.now/CVE-2024-55661.md): Laravel Pulse Allows Remote Code Execution via Unprotected Query Method (CVSS 8.7, laravel pulse · laravel/pulse)
- [CVE-2024-54139](https://cve.now/CVE-2024-54139.md): Combodo iTop vulnerable to XSS leading to CSRF breach on \_table\_id parameter (CVSS 7.9, Combodo iTop)
- [CVE-2024-9945](https://cve.now/CVE-2024-9945.md): Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0 (CVSS 5.3, Fortra GoAnywhere MFT)
- [CVE-2024-54351](https://cve.now/CVE-2024-54351.md): WordPress Fancy Roller Scroller plugin \<= 1.4.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Thomas K Landis Fancy Roller Scroller)
- [CVE-2024-54349](https://cve.now/CVE-2024-54349.md): WordPress Plain Post plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mashiurz Plain Post)
- [CVE-2024-54347](https://cve.now/CVE-2024-54347.md): WordPress FloristPress plugin \<= 7.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BAKKBONE Australia FloristPress)
- [CVE-2024-54346](https://cve.now/CVE-2024-54346.md): WordPress Barter theme \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 Barter)
- [CVE-2024-54345](https://cve.now/CVE-2024-54345.md): WordPress Bicycleshop theme \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sonalsinha21 Bicycleshop)
- [CVE-2024-54344](https://cve.now/CVE-2024-54344.md): WordPress WP Quick Shop plugin \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Fahad Mahmood WP Quick Shop)
- [CVE-2024-54343](https://cve.now/CVE-2024-54343.md): WordPress Connect Contact Form 7 to Constant Contact plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, thehowarde Connect Contact Form 7 to Constant Contact)
- [CVE-2024-54342](https://cve.now/CVE-2024-54342.md): WordPress Staggs plugin \<= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, STAGGS)
- [CVE-2024-54341](https://cve.now/CVE-2024-54341.md): WordPress LabelGrid Tools plugin \<= 1.3.58 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LabelGrid Tools)
- [CVE-2024-54340](https://cve.now/CVE-2024-54340.md): WordPress Simple Presenter plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sylviavanos Simple Presenter)
- [CVE-2024-54339](https://cve.now/CVE-2024-54339.md): WordPress geoFlickr plugin \<= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jbd7 geoFlickr)
- [CVE-2024-54338](https://cve.now/CVE-2024-54338.md): WordPress Hello Event Widgets For Elementor plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, christer\_f Hello Event Widgets For Elementor)
- [CVE-2024-54337](https://cve.now/CVE-2024-54337.md): WordPress DX Dark Site plugin \<= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, DevriX DX Dark Site)
- [CVE-2024-54336](https://cve.now/CVE-2024-54336.md): WordPress Projectopia plugin \<= 5.1.7 - Account Takeover vulnerability (CVSS 8.8, Projectopia)
- [CVE-2024-54335](https://cve.now/CVE-2024-54335.md): WordPress ImmoToolBox Connect plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ImmoSoft ImmoToolBox Connect)
- [CVE-2024-54334](https://cve.now/CVE-2024-54334.md): WordPress Quran Phrases About Most People Shortcodes plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zeshanb Quran Phrases About Most People Shortcodes)
- [CVE-2024-54333](https://cve.now/CVE-2024-54333.md): WordPress Check Pincode For Woocommerce plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, silverplugins217 Check Pincode For Woocommerce)
- [CVE-2024-54330](https://cve.now/CVE-2024-54330.md): WordPress Hurrakify plugin \<= 2.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Hurrakify)
- [CVE-2024-54329](https://cve.now/CVE-2024-54329.md): WordPress CleverNode Related Content plugin \<= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Metup CleverNode Related Content)
- [CVE-2024-54328](https://cve.now/CVE-2024-54328.md): WordPress Invoice Payment for WooCommerce plugin \<= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, linknacional Invoice Payment for WooCommerce)
- [CVE-2024-54327](https://cve.now/CVE-2024-54327.md): WordPress UNIVERSAM plugin \< 8.59 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, UNIVERSAM)
- [CVE-2024-54326](https://cve.now/CVE-2024-54326.md): WordPress GEO my WP plugin \<= 4.5.0.4 - Broken Access Control vulnerability (CVSS 6.5, Eyal Fitoussi GEO my WordPress)
- [CVE-2024-54325](https://cve.now/CVE-2024-54325.md): WordPress CarDealerPress plugin \<= 6.6.2410.02 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DealerTrend CarDealerPress)
- [CVE-2024-54324](https://cve.now/CVE-2024-54324.md): WordPress SMSify plugin \<= 6.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mtomic SMSify)
- [CVE-2024-54323](https://cve.now/CVE-2024-54323.md): WordPress New User Approve plugin \<= 2.6.2 - Broken Access Control vulnerability (CVSS 5.4, Saad Iqbal New User Approve)
- [CVE-2024-54322](https://cve.now/CVE-2024-54322.md): WordPress Media Downloader plugin \<= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ederson Peka Media Downloader)
- [CVE-2024-54321](https://cve.now/CVE-2024-54321.md): WordPress Hive Support plugin \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Hive Support)
- [CVE-2024-54320](https://cve.now/CVE-2024-54320.md): WordPress ICDSoft Reseller Store plugin\<= 2.4.5 -Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ICDSoft Reseller Store)
- [CVE-2024-54319](https://cve.now/CVE-2024-54319.md): WordPress Kundgenerator plugin \<= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kundgenerator)
- [CVE-2024-54318](https://cve.now/CVE-2024-54318.md): WordPress NiceJob plugin \<= 3.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, NiceJob)
- [CVE-2024-54317](https://cve.now/CVE-2024-54317.md): WordPress Web Stories plugin \<= 1.37.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Google Web Stories)
- [CVE-2024-54316](https://cve.now/CVE-2024-54316.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Restaurant & Cafe Addon for Elementor)
- [CVE-2024-54315](https://cve.now/CVE-2024-54315.md): WordPress Events Addon for Elementor plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Events Addon for Elementor)
- [CVE-2024-54314](https://cve.now/CVE-2024-54314.md): WordPress Primary Addon for Elementor plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Primary Addon for Elementor)
- [CVE-2024-54313](https://cve.now/CVE-2024-54313.md): WordPress FULL – Cliente plugin \<= 3.1.25 - Local File Inclusion vulnerability (CVSS 6.5, FULL. FULL Customer)
- [CVE-2024-54312](https://cve.now/CVE-2024-54312.md): WordPress افزونه پیامک ووکامرس Persian WooCommerce SMS plugin \<= 7.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PersianScript Persian Woocommerce SMS)
- [CVE-2024-54311](https://cve.now/CVE-2024-54311.md): WordPress Mark New Posts plugin \<= 7.5.1 - Broken Access Control vulnerability (CVSS 5.4, i.lychkov Mark New Posts)
- [CVE-2024-54310](https://cve.now/CVE-2024-54310.md): WordPress Gou Manage My Account Menu plugin \<= 1.0.1.8 - Broken Access Control vulnerability (CVSS 5.3, Aslam Khan Gouran Gou Manage My Account Menu)
- [CVE-2024-54309](https://cve.now/CVE-2024-54309.md): WordPress PostBox plugin \<= 1.0.4 - Sensitive Data Exposure vulnerability (CVSS 6.5, wpdebuglog PostBox)
- [CVE-2024-54308](https://cve.now/CVE-2024-54308.md): WordPress Cryptocurrency Price Widget plugin \<= 1.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, falselight Cryptocurrency Price Widget)
- [CVE-2024-54307](https://cve.now/CVE-2024-54307.md): WordPress AIcomments plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, aipost AIcomments)
- [CVE-2024-54306](https://cve.now/CVE-2024-54306.md): WordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin \<= 1.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best A…)
- [CVE-2024-54305](https://cve.now/CVE-2024-54305.md): WordPress J&T Express Malaysia plugin \<= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jtexpress J&T Express Malaysia)
- [CVE-2024-54304](https://cve.now/CVE-2024-54304.md): WordPress Hive Support plugin \<= 1.1.2 - SQL Injection vulnerability (CVSS 8.5, Hive Support)
- [CVE-2024-54303](https://cve.now/CVE-2024-54303.md): WordPress Simple Payment plugin \<= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ido Kobelkowsky Simple Payment)
- [CVE-2024-54302](https://cve.now/CVE-2024-54302.md): WordPress VForm plugin \<= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vikas Ratudi VPSUForm)
- [CVE-2024-54301](https://cve.now/CVE-2024-54301.md): WordPress FormFacade plugin \<= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, manidoraisamy FormFacade)
- [CVE-2024-54300](https://cve.now/CVE-2024-54300.md): WordPress AutoWP plugin \<= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Basar Ventures AutoWP)
- [CVE-2024-54299](https://cve.now/CVE-2024-54299.md): WordPress Revi.io plugin \<= 5.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, revidev Revi.io)
- [CVE-2024-54298](https://cve.now/CVE-2024-54298.md): WordPress Car Dealer plugin \<= 4.46 - Broken Access Control vulnerability (CVSS 4.3, sminozzi Car Dealer)
- [CVE-2024-54297](https://cve.now/CVE-2024-54297.md): WordPress vBSSO-lite plugin \<= 1.4.3 - Account Takeover vulnerability (CVSS 9.8, extremeidea vBSSO-lite)
- [CVE-2024-54296](https://cve.now/CVE-2024-54296.md): WordPress CoSchool LMS plugin \<= 1.4.3 - Account Takeover vulnerability (CVSS 9.8, Codexpert CoSchool LMS)
- [CVE-2024-54295](https://cve.now/CVE-2024-54295.md): WordPress ListApp Mobile Manager plugin \<= 1.7.7 - Account Takeover vulnerability (CVSS 9.8, FluxBuilder ListApp Mobile Manager)
- [CVE-2024-54294](https://cve.now/CVE-2024-54294.md): WordPress Firebase OTP Authentication plugin \<= 1.0.1 - Account Takeover vulnerability (CVSS 9.8, Appgenix Infotech Firebase OTP Authentication)
- [CVE-2024-54293](https://cve.now/CVE-2024-54293.md): WordPress CE21 Suite plugin \<= 2.2.0 - Privilege Escalation vulnerability (CVSS 9.8, CE21 Suite)
- [CVE-2024-54292](https://cve.now/CVE-2024-54292.md): WordPress Appsplate plugin \<= 2.1.3 - SQL Injection vulnerability (CVSS 9.3, Appsplate)
- [CVE-2024-54290](https://cve.now/CVE-2024-54290.md): WordPress Role Includer plugin \<= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Justin Fletcher Role Includer)
- [CVE-2024-54289](https://cve.now/CVE-2024-54289.md): WordPress Awesome Support plugin \<= 6.3.1 - Broken Access Control vulnerability (CVSS 6.5, awesomesupport Awesome Support)
- [CVE-2024-54288](https://cve.now/CVE-2024-54288.md): WordPress LDD Directory Lite plugin \<= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LDD Web Design LDD Directory Lite)
- [CVE-2024-54287](https://cve.now/CVE-2024-54287.md): WordPress Advanced Blog Post Block plugin \<= 1.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Best WP Developer Advanced Blog Post Block)
- [CVE-2024-54286](https://cve.now/CVE-2024-54286.md): WordPress Smaily for WP plugin \<= 3.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Smaily for WP)
- [CVE-2024-54282](https://cve.now/CVE-2024-54282.md): WordPress WP Mega Menu plugin \<= 1.4.2 - PHP Object Injection vulnerability (CVSS 7.2, Themeum WP Mega Menu)
- [CVE-2024-54278](https://cve.now/CVE-2024-54278.md): WordPress News Ticker for Elementor plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 4.3, Plugin Devs News Ticker for Elementor)
- [CVE-2024-54277](https://cve.now/CVE-2024-54277.md): WordPress Nias course plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alireza Aliniya Nias course)
- [CVE-2024-54276](https://cve.now/CVE-2024-54276.md): WordPress Poll Builder plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, devfelixmoira Poll Builder)
- [CVE-2024-54275](https://cve.now/CVE-2024-54275.md): WordPress CSV to html plugin \<= 3.08 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wibergsweb CSV to html)
- [CVE-2024-54274](https://cve.now/CVE-2024-54274.md): WordPress Octrace Support plugin \<= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WordPress HelpDesk & Support Ticket System Plugin – Octrace…)
- [CVE-2024-54273](https://cve.now/CVE-2024-54273.md): WordPress Mail Picker plugin \<= 1.0.14 - PHP Object Injection vulnerability (CVSS 9.8, PickPlugins Mail Picker)
- [CVE-2024-54272](https://cve.now/CVE-2024-54272.md): WordPress Radius Blocks plugin \<= 2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RadiusTheme Radius Blocks)
- [CVE-2024-54271](https://cve.now/CVE-2024-54271.md): WordPress WPCargo Track & Trace plugin \<= 8.0.2 - Settings Change vulnerability (CVSS 5.4, Arni Cinco WPCargo Track & Trace)
- [CVE-2024-54268](https://cve.now/CVE-2024-54268.md): WordPress SiteOrigin Widgets Bundle plugin \<= 1.64.0 - Broken Access Control vulnerability (CVSS 4.3, Greg - SiteOrigin SiteOrigin Widgets Bundle)
- [CVE-2024-54267](https://cve.now/CVE-2024-54267.md): WordPress CM Answers plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 4.3, CreativeMindsSolutions CM Answers)
- [CVE-2024-54266](https://cve.now/CVE-2024-54266.md): WordPress ImageRecycle pdf & image compression plugin \<= 3.1.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ImageRecycle pdf & image compression)
- [CVE-2024-54265](https://cve.now/CVE-2024-54265.md): WordPress Barcode Scanner and Inventory manager plugin \<= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2024-54264](https://cve.now/CVE-2024-54264.md): WordPress Shortcodes Blocks Creator Ultimate plugin \<= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmorillas1 Shortcodes Blocks Creator Ultimate)
- [CVE-2024-54262](https://cve.now/CVE-2024-54262.md): WordPress Import Export For WooCommerce plugin \<= 1.6.2 - Arbitrary File Upload vulnerability (CVSS 9.9, sidngr Import Export For WooCommerce)
- [CVE-2024-54261](https://cve.now/CVE-2024-54261.md): WordPress TAX SERVICE Electronic HDM plugin \<= 1.2.2 - SQL Injection vulnerability (CVSS 10.0, HK Digital Agency TAX SERVICE Electronic HDM)
- [CVE-2024-54259](https://cve.now/CVE-2024-54259.md): WordPress DELUCKS SEO plugin \<= 2.7.0 - Arbitrary File Download vulnerability (CVSS 6.5, DELUCKS SEO)
- [CVE-2024-54258](https://cve.now/CVE-2024-54258.md): WordPress Ni CRM Lead plugin \<= 1.3.0 - SQL Injection vulnerability (CVSS 8.5, Anzar Ahmed Ni CRM Lead)
- [CVE-2024-54256](https://cve.now/CVE-2024-54256.md): WordPress Easy Blocks pro plugin \<= 1.0.21 - Broken Access Control vulnerability (CVSS 7.1, Seerox Easy Blocks pro)
- [CVE-2024-54252](https://cve.now/CVE-2024-54252.md): WordPress Pinpoint Booking System Plugin \<= 2.9.9.5.7 - Broken Access Control vulnerability (CVSS 6.3, DOTonPAPER Pinpoint Booking System)
- [CVE-2024-54250](https://cve.now/CVE-2024-54250.md): WordPress Prodigy Commerce plugin \<= 3.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, prodigycommerce Prodigy Commerce)
- [CVE-2024-54248](https://cve.now/CVE-2024-54248.md): WordPress Eewee Admin Custom plugin \<= 1.8.2.4 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, eewee admin custom)
- [CVE-2024-54246](https://cve.now/CVE-2024-54246.md): WordPress FAQs plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Think201 FAQs)
- [CVE-2024-54245](https://cve.now/CVE-2024-54245.md): WordPress Clients plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Think201 Clients)
- [CVE-2024-54244](https://cve.now/CVE-2024-54244.md): WordPress Easy Replace plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Think201 Easy Replace)
- [CVE-2024-54243](https://cve.now/CVE-2024-54243.md): WordPress Echoza plugin \<= 0.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Think201 Echoza)
- [CVE-2024-54242](https://cve.now/CVE-2024-54242.md): WordPress Simple Notification plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 6.5, appsbd Simple Notification)
- [CVE-2024-54241](https://cve.now/CVE-2024-54241.md): WordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Appsbd Elite Notification – Sales Popup, Social Proof, FOMO…)
- [CVE-2024-54240](https://cve.now/CVE-2024-54240.md): WordPress Blaze Online eParcel for WooCommerce plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, blazeonline Blaze Online eParcel for WooCommerce)
- [CVE-2024-54239](https://cve.now/CVE-2024-54239.md): WordPress Eyewear prescription form plugin \<= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, dugudlabs Eyewear prescription form)
- [CVE-2024-54238](https://cve.now/CVE-2024-54238.md): WordPress Board Document Manager from CHUHPL plugin \<= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cleveland Heights-University Heights Public Library Webdeve…)
- [CVE-2024-54237](https://cve.now/CVE-2024-54237.md): WordPress Ni CRM Lead plugin \<= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anzar Ahmed Ni CRM Lead)
- [CVE-2024-54236](https://cve.now/CVE-2024-54236.md): WordPress Ni WooCommerce Bulk Product Editor plugin \<= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anzar Ahmed Ni WooCommerce Bulk Product Editor)
- [CVE-2024-54235](https://cve.now/CVE-2024-54235.md): WordPress Shiptimize for WooCommerce plugin \<= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shiptimize for WooCommerce)
- [CVE-2024-54234](https://cve.now/CVE-2024-54234.md): WordPress Limit Login Attempts plugin \<= 5.5 - SQL Injection vulnerability (CVSS 9.3, wp-buy Limit Login Attempts)
- [CVE-2024-54233](https://cve.now/CVE-2024-54233.md): WordPress Advanced Control Manager plugin \<= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, overclokk Advanced Control Manager for WordPress by ItalySt…)
- [CVE-2024-54231](https://cve.now/CVE-2024-54231.md): WordPress Ni WooCommerce Order Export plugin \<= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anzar Ahmed Ni WooCommerce Order Export)
- [CVE-2023-44149](https://cve.now/CVE-2023-44149.md): WordPress Brands for WooCommerce plugin \<= 3.8.2.2 - Broken Access Control vulnerability (CVSS 5.3, BeRocket Brands for WooCommerce)
- [CVE-2023-44147](https://cve.now/CVE-2023-44147.md): WordPress Comment Blacklist Updater plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, apasionados Comment Blacklist Updater)
- [CVE-2023-44142](https://cve.now/CVE-2023-44142.md): WordPress Inactive Logout plugin \<= 3.2.2 - Broken Access Control vulnerability (CVSS 5.4, Deepen Bajracharya Inactive Logout)
- [CVE-2023-41952](https://cve.now/CVE-2023-41952.md): WordPress Fluent Forms plugin \<= 5.0.8 - Broken Access Control vulnerability (CVSS 5.3, Contact Form - WPManageNinja FluentForm)
- [CVE-2023-41951](https://cve.now/CVE-2023-41951.md): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin \<= 4.6.14 - Broken Access Control vulnerability (CVSS 4.3, rtCamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2023-41875](https://cve.now/CVE-2023-41875.md): WordPress WP Directory Kit plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 5.3, wpdirectorykit.com WP Directory Kit)
- [CVE-2023-41873](https://cve.now/CVE-2023-41873.md): WordPress SAML Single Sign On – SSO Login plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 4.3, miniOrange SAML SP Single Sign On)
- [CVE-2023-41870](https://cve.now/CVE-2023-41870.md): WordPress WP Crowdfunding plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 4.3, Themeum WP Crowdfunding)
- [CVE-2023-41869](https://cve.now/CVE-2023-41869.md): WordPress WP Accessibility Helper (WAH) plugin \<= 0.6.2.4 - Broken Access Control vulnerability (CVSS 4.3, Alex Volkov WP Accessibility Helper)
- [CVE-2023-41866](https://cve.now/CVE-2023-41866.md): WordPress Automatic YouTube Gallery plugin \<= 2.3.3 - Broken Access Control vulnerability (CVSS 4.3, Team Plugins360 Automatic YouTube Gallery)
- [CVE-2023-41865](https://cve.now/CVE-2023-41865.md): WordPress Slider Pro plugin \<= 4.8.6 - Broken Access Control vulnerability (CVSS 4.3, bqworks Slider Pro)
- [CVE-2023-41862](https://cve.now/CVE-2023-41862.md): WordPress VS Contact Form plugin \<= 14.0 - Sum Captcha Bypass vulnerability (CVSS 5.3, Guido VS Contact Form)
- [CVE-2023-41857](https://cve.now/CVE-2023-41857.md): WordPress Click To Tweet plugin \<= 2.0.14 - Broken Access Control vulnerability (CVSS 5.4, ClickToTweet.com Click To Tweet)
- [CVE-2023-41849](https://cve.now/CVE-2023-41849.md): WordPress Posts Like Dislike plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 5.3, WP Happy Coders Posts Like Dislike)
- [CVE-2023-41848](https://cve.now/CVE-2023-41848.md): WordPress Carousel Slider plugin \<= 2.2.2 - Broken Access Control vulnerability (CVSS 5.3, Majeed Raza Carousel Slider)
- [CVE-2023-41803](https://cve.now/CVE-2023-41803.md): WordPress BitPay Checkout for WooCommerce plugin \<= 4.1.0 - Broken Access Control vulnerability (CVSS 5.3, BitPay Checkout for WooCommerce)
- [CVE-2023-41802](https://cve.now/CVE-2023-41802.md): WordPress Super Socializer plugin \<= 7.13.54 - Broken Access Control vulnerability (CVSS 4.3, Team Heateor Super Socializer)
- [CVE-2023-41695](https://cve.now/CVE-2023-41695.md): WordPress Analytify plugin \<= 5.1.0 - Broken Access Control vulnerability (CVSS 3.5, Adnan Analytify)
- [CVE-2023-41690](https://cve.now/CVE-2023-41690.md): WordPress WiserNotify Social Proof plugin \<= 2.5 - Broken Access Control vulnerability (CVSS 5.3, Wiser Notify WiserNotify Social Proof)
- [CVE-2023-41689](https://cve.now/CVE-2023-41689.md): WordPress Post to Google My Business (Google Business Profile) plugin \<= 3.1.14 - Broken Access Control vulnerability (CVSS 4.3, Koen Reus Post to Google My Business)
- [CVE-2023-41688](https://cve.now/CVE-2023-41688.md): WordPress Bulk NoIndex & NoFollow Toolkit plugin \<= 1.5 - Broken Access Control vulnerability (CVSS 5.4, Mad Fish Digital Bulk NoIndex & NoFollow Toolkit)
- [CVE-2023-41686](https://cve.now/CVE-2023-41686.md): WordPress Woocommerce Support System plugin \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, ilGhera Woocommerce Support System)
- [CVE-2023-41683](https://cve.now/CVE-2023-41683.md): WordPress TelSender plugin \<= 1.14.11 - Broken Access Control + CSRF vulnerability (CVSS 5.4, Pechenki TelSender)
- [CVE-2023-41671](https://cve.now/CVE-2023-41671.md): WordPress Abandoned Cart Lite for WooCommerce plugin \<= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, tychesoftwares Abandoned Cart Lite for WooCommerce)
- [CVE-2023-41664](https://cve.now/CVE-2023-41664.md): WordPress Easy Newsletter Signups plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 6.5, AlphaBPO Easy Newsletter Signups)
- [CVE-2023-41649](https://cve.now/CVE-2023-41649.md): WordPress Ovic Product Bundle plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 6.5, Ovic Team Ovic Product Bundle)
- [CVE-2023-41133](https://cve.now/CVE-2023-41133.md): WordPress Secure Admin IP plugin \<= 2.0 - IP Spoofing vulnerability (CVSS 5.3, Michal Novák Secure Admin IP)
- [CVE-2023-41132](https://cve.now/CVE-2023-41132.md): WordPress Category Slider for WooCommerce plugin \<= 1.4.15 - Broken Access Control vulnerability (CVSS 4.3, ShapedPlugin Category Slider for WooCommerce)
- [CVE-2023-41130](https://cve.now/CVE-2023-41130.md): WordPress Premmerce User Roles plugin \<= 1.0.12 - Broken Access Control vulnerability (CVSS 8.1, Premmerce User Roles)
- [CVE-2023-40678](https://cve.now/CVE-2023-40678.md): WordPress Simple URLs plugin \<= 117 - Broken Access Control vulnerability (CVSS 5.4, Andrew Fiebert Simple URLs)
- [CVE-2023-40670](https://cve.now/CVE-2023-40670.md): WordPress ReviewX plugin \<= 1.6.17 - Broken Access Control vulnerability (CVSS 4.3, ReviewX Team ReviewX)
- [CVE-2023-40334](https://cve.now/CVE-2023-40334.md): WordPress HUSKY plugin \<= 1.3.4.2 - Broken Access Control vulnerability (CVSS 4.3, RealMag777 HUSKY)
- [CVE-2023-40331](https://cve.now/CVE-2023-40331.md): WordPress Accordion Slider plugin \<= 1.9.6 - Broken Access Control vulnerability (CVSS 4.3, bqworks Accordion Slider)
- [CVE-2023-40213](https://cve.now/CVE-2023-40213.md): WordPress Justified Gallery plugin \<= 1.7.3 - Broken Access Control vulnerability (CVSS 4.3, Mateusz Czardybon Justified Gallery)
- [CVE-2023-40203](https://cve.now/CVE-2023-40203.md): WordPress MailChimp Forms by MailMunch plugin \<= 3.1.4 - Broken Access Control (CVSS 4.3, MailChimp Forms by MailMunch)
- [CVE-2023-40011](https://cve.now/CVE-2023-40011.md): WordPress Cost Calculator Builder plugin \<= 3.1.42 - Broken Access Control vulnerability (CVSS 5.4, StylemixThemes Cost Calculator Builder)
- [CVE-2023-40005](https://cve.now/CVE-2023-40005.md): WordPress Easy Digital Downloads plugin \<= 3.1.5 - Broken Access Control (CVSS 5.3, Syed Balkhi Easy Digital Downloads)
- [CVE-2023-40003](https://cve.now/CVE-2023-40003.md): WordPress WP Project Manager plugin \<= 2.6.7 - Broken Access Control vulnerability (CVSS 6.5, weDevs WP Project Manager)
- [CVE-2023-40001](https://cve.now/CVE-2023-40001.md): WordPress iThemes Sync plugin \<= 2.1.13 - Broken Access Control vulnerability (CVSS 4.3, SolidWP iThemes Sync)
- [CVE-2023-39997](https://cve.now/CVE-2023-39997.md): WordPress Popup by Supsystic plugin \<= 1.10.19 - Broken Access Control Vulnerability (CVSS 5.3, supsystic.com Popup by Supsystic)
- [CVE-2023-39996](https://cve.now/CVE-2023-39996.md): WordPress Accordion and Accordion Slider plugin \<= 1.2.4 - Broken Access Control (CVSS 5.3, WP OnlineSupport, Essential Plugin Accordion and Accordion…)
- [CVE-2023-39995](https://cve.now/CVE-2023-39995.md): WordPress Portfolio and Projects plugin \<= 1.3.7 - Broken Access Control vulnerability (CVSS 4.3, WP OnlineSupport, Essential Plugin Portfolio and Projects)
- [CVE-2023-39920](https://cve.now/CVE-2023-39920.md): WordPress Redirection for Contact Form 7 plugin \<= 2.9.2 - Broken Access Control vulnerability (CVSS 7.5, Themeisle Redirection for Contact Form)
- [CVE-2023-39305](https://cve.now/CVE-2023-39305.md): WordPress Yet Another Stars Rating plugin \<= 3.4.3 - Broken Access Control vulnerability (CVSS 5.3, Dash Labs Yet Another Stars Rating)
- [CVE-2023-38514](https://cve.now/CVE-2023-38514.md): WordPress Social Share Icons & Social Share Buttons plugin \<= 3.5.7 - Broken Access Control vulnerability (CVSS 4.3, social share pro Social Share Icons & Social Share Buttons)
- [CVE-2023-38483](https://cve.now/CVE-2023-38483.md): WordPress Instant CSS plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 5.4, Dylan Blokhuis Instant CSS)
- [CVE-2023-38480](https://cve.now/CVE-2023-38480.md): WordPress Booster Elementor Addons plugin \<= 1.4.9 - Broken Access Control vulnerability (CVSS 5.3, Certain Dev Booster Elementor Addons)
- [CVE-2023-38479](https://cve.now/CVE-2023-38479.md): WordPress Simple Googlebot Visit plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 5.3, Codents Simple Googlebot Visit)
- [CVE-2023-38477](https://cve.now/CVE-2023-38477.md): WordPress QR code MeCard/vCard generator plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 4.3, Stanislav Kuznetsov QR code MeCard/vCard generator)
- [CVE-2023-38475](https://cve.now/CVE-2023-38475.md): WordPress Donations Made Easy – Smart Donations plugin \<= 4.0.12 - Broken Access Control vulnerability (CVSS 4.3, RedNao Donations Made Easy – Smart Donations)
- [CVE-2023-38385](https://cve.now/CVE-2023-38385.md): WordPress Jupiter X Core plugin \<= 3.3.0 - Multiple Auth. Broken Access Control vulnerability (CVSS 8.3, Artbees JupiterX Core)
- [CVE-2023-38383](https://cve.now/CVE-2023-38383.md): WordPress Language plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 5.4, OnTheGoSystems Language)
- [CVE-2023-37989](https://cve.now/CVE-2023-37989.md): WordPress Easyship WooCommerce Shipping Rates plugin \<= 0.9.0 - Broken Access Control vulnerability (CVSS 5.4, Easyship WooCommerce Shipping Rates)
- [CVE-2023-37987](https://cve.now/CVE-2023-37987.md): WordPress YourMembership Single Sign On plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.5, miniOrange YourMembership Single Sign On)
- [CVE-2023-37984](https://cve.now/CVE-2023-37984.md): WordPress Quiz And Survey Master plugin \<= 8.1.10 - Broken Access Control vulnerability (CVSS 4.3, ExpressTech Quiz And Survey Master)
- [CVE-2023-37971](https://cve.now/CVE-2023-37971.md): WordPress WooCommerce Product Stock Alert plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 6.5, MultiVendorX WooCommerce Product Stock Alert)
- [CVE-2023-37969](https://cve.now/CVE-2023-37969.md): WordPress Checkout with Zelle on Woocommerce plugin \<= 3.1 - Broken Access Control vulnerability (CVSS 5.3, The African Boss Checkout with Zelle on Woocommerce)
- [CVE-2023-37967](https://cve.now/CVE-2023-37967.md): WordPress DirectoryPress plugin \<= 3.6.2 - Unauthenticated Broken Access Control Vulnerability (CVSS 6.5, Designinvento DirectoryPress)
- [CVE-2023-37887](https://cve.now/CVE-2023-37887.md): WordPress WPSchoolPress plugin \<= 2.2.7 - Broken Access Control vulnerability (CVSS 6.5, WPSchoolPress Team WPSchoolPress)
- [CVE-2023-36681](https://cve.now/CVE-2023-36681.md): WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin \<= 2.6.2 - Broken Access Control vulnerability (CVSS 5.3, Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins…)
- [CVE-2023-36680](https://cve.now/CVE-2023-36680.md): WordPress Image Regenerate & Select Crop plugin \<= 7.1.0 - Broken Access Control vulnerability (CVSS 5.4, Iulia Cazan Image Regenerate & Select Crop)
- [CVE-2023-36531](https://cve.now/CVE-2023-36531.md): WordPress LiquidPoll plugin \<= 3.3.68 - Broken Access Control vulnerability (CVSS 4.3, LiquidPoll – Advanced Polls for Creators and Brands)
- [CVE-2023-36528](https://cve.now/CVE-2023-36528.md): WordPress kk Star Ratings plugin \<= 5.4.3 - Rate Manipulation due to IP Spoofing Vulnerability (CVSS 5.3, FeedbackWP kk Star Ratings)
- [CVE-2023-36526](https://cve.now/CVE-2023-36526.md): WordPress Duplicate Post Page Menu & Custom Post Type plugin \<= 2.4.1 - Broken Access Control vulnerability (CVSS 5.4, Inqsys Technology Duplicate Post Page Menu & Custom Post Ty…)
- [CVE-2023-36519](https://cve.now/CVE-2023-36519.md): WordPress SW Product Bundles plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 5.4, wpthemego SW Product Bundles)
- [CVE-2023-36518](https://cve.now/CVE-2023-36518.md): WordPress Post Hit Counter plugin \<= 1.3.2 - Broken Access Control (CVSS 4.3, Hugh Lashbrooke Post Hit Counter)
- [CVE-2023-36510](https://cve.now/CVE-2023-36510.md): WordPress ReDi Restaurant Reservation plugin \<= 23.0211 - Broken Access Control vulnerability (CVSS 7.3, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2023-36509](https://cve.now/CVE-2023-36509.md): WordPress CHP Ads Block Detector plugin \<= 3.9.5 - Broken Access Control vulnerability (CVSS 5.4, Suresh Chand CHP Ads Block Detector)
- [CVE-2023-36506](https://cve.now/CVE-2023-36506.md): WordPress YITH WooCommerce Waitlist plugin \<= 2.13.0 - Broken Access Control vulnerability (CVSS 5.3, YITH WooCommerce Waiting List)
- [CVE-2023-35875](https://cve.now/CVE-2023-35875.md): WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 5.3, Jegstudio Gutenverse)
- [CVE-2023-35777](https://cve.now/CVE-2023-35777.md): WordPress The Events Calendar plugin \<= 6.1.2.2 - Broken Access Control vulnerability (CVSS 5.3, The Events Calendar)
- [CVE-2023-35052](https://cve.now/CVE-2023-35052.md): WordPress Directorist plugin \<= 7.5.4 - Arbitrary Content Deletion vulnerability (CVSS 4.3, wpWax - WP Business Directory Plugin and Classified Listing…)
- [CVE-2023-35051](https://cve.now/CVE-2023-35051.md): WordPress Contact Forms by Cimatti plugin \<= 1.5.7 - Broken Access Control vulnerability (CVSS 5.4, Cimatti Consulting Contact Forms by Cimatti)
- [CVE-2023-35046](https://cve.now/CVE-2023-35046.md): WordPress Dynamic Visibility for Elementor plugin \<= 5.0.5 - Broken Access Control vulnerability (CVSS 5.4, Dynamic.ooo Dynamic Visibility for Elementor)
- [CVE-2023-35037](https://cve.now/CVE-2023-35037.md): WordPress Surfer plugin \<= 1.3.2.357 - Broken Access Control vulnerability (CVSS 7.6, Surfer)
- [CVE-2023-34387](https://cve.now/CVE-2023-34387.md): WordPress Constant Contact Forms plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 4.3, Constant Contact Forms)
- [CVE-2023-34381](https://cve.now/CVE-2023-34381.md): WordPress Zippy plugin \<= 1.6.2 - Broken Access Control vulnerability (CVSS 5.3, Gesundheit Bewegt Zippy)
- [CVE-2023-34376](https://cve.now/CVE-2023-34376.md): WordPress Change WooCommerce Add To Cart Button Text plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 5.4, Rextheme Change WooCommerce Add To Cart Button Text)
- [CVE-2023-34019](https://cve.now/CVE-2023-34019.md): WordPress Uncanny Toolkit for LearnDash plugin \<= 3.6.4.3 - Broken Access Control vulnerability (CVSS 6.5, Uncanny Owl Uncanny Toolkit for LearnDash)
- [CVE-2023-34014](https://cve.now/CVE-2023-34014.md): WordPress Grid Plus plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.4, G5Theme Grid Plus)
- [CVE-2023-34009](https://cve.now/CVE-2023-34009.md): WordPress Social Media Share Buttons & Social Sharing Icons plugin \<= 2.8.1 - Broken Access Control + CSRF (CVSS 4.3, Inisev Social Media & Share Icons)
- [CVE-2023-33998](https://cve.now/CVE-2023-33998.md): WordPress Easy Social Icons plugin \<= 3.2.5 - Broken Access Control vulnerability (CVSS 4.3, cybernetikz Easy Social Icons)
- [CVE-2023-33996](https://cve.now/CVE-2023-33996.md): WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin \<= 6.10 - Broken Access Control vulnerability (CVSS 8.8, СleanTalk - Anti-Spam Protection Spam protection, AntiSpam,…)
- [CVE-2023-33995](https://cve.now/CVE-2023-33995.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.15 - Broken Access Control vulnerability (CVSS 4.3, Photo Gallery Team Photo Gallery by 10Web)
- [CVE-2023-33994](https://cve.now/CVE-2023-33994.md): WordPress Slimstat Analytics plugin \<= 5.0.5.1 - Broken Access Control vulnerability (CVSS 6.5, VeronaLabs Slimstat Analytics)
- [CVE-2023-33928](https://cve.now/CVE-2023-33928.md): WordPress WordPress Backup & Migration plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, WebToffee WordPress Backup & Migration)
- [CVE-2023-33324](https://cve.now/CVE-2023-33324.md): WordPress Easy Captcha plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 6.5, wppal Easy Captcha)
- [CVE-2023-33215](https://cve.now/CVE-2023-33215.md): WordPress Taggbox plugin \<= 3.3 - Broken Access Control vulnerability (CVSS 5.4, Taggbox)
- [CVE-2023-32963](https://cve.now/CVE-2023-32963.md): WordPress Predictive Search for WooCommerce plugin \<= 5.8.0 - Broken Access Control vulnerability (CVSS 5.3, a3rev Software WooCommerce Predictive Search)
- [CVE-2023-32798](https://cve.now/CVE-2023-32798.md): WordPress Simple Page Ordering plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.3, 10up Simple Page Ordering)
- [CVE-2023-32601](https://cve.now/CVE-2023-32601.md): WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin \<= 1.1.12 - Broken Access Control vulnerability (CVSS 5.4, Booking Ultra Pro)
- [CVE-2023-32599](https://cve.now/CVE-2023-32599.md): WordPress reCAPTCHA for all plugin \<= 1.22 - Broken Access Control vulnerability (CVSS 4.3, Bill Minozzi reCAPTCHA for all)
- [CVE-2023-32593](https://cve.now/CVE-2023-32593.md): WordPress GS Pins for Pinterest plugin \<= 1.6.7 - Broken Access Control vulnerability (CVSS 5.4, GS Plugins GS Pins for Pinterest)
- [CVE-2023-32586](https://cve.now/CVE-2023-32586.md): WordPress SoundCloud Is Gold plugin \<= 2.5.1 - Broken Access Control vulnerability (CVSS 4.3, Thomas Michalak Soundcloud Is Gold)
- [CVE-2023-32585](https://cve.now/CVE-2023-32585.md): WordPress Portfolio Gallery – Responsive Image Gallery plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 7.5, Total-Soft Portfolio Gallery – Responsive Image Gallery)
- [CVE-2023-32581](https://cve.now/CVE-2023-32581.md): WordPress WP-Chatbot for Messenger plugin \<= 4.7 - Broken Access Control (CVSS 5.4, MobileMonkey WP-Chatbot for Messenger)
- [CVE-2023-32574](https://cve.now/CVE-2023-32574.md): WordPress Injection Guard plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3, Fahad Mahmood Injection Guard)
- [CVE-2023-32520](https://cve.now/CVE-2023-32520.md): WordPress WCP Contact Form plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 7.5, Webcodin WCP Contact Form)
- [CVE-2023-32519](https://cve.now/CVE-2023-32519.md): WordPress WCP Contact Form plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 4.3, Webcodin WCP Contact Form)
- [CVE-2023-32507](https://cve.now/CVE-2023-32507.md): WordPress Woo Custom Emails plugin \<= 2.2 - Broken Access Control vulnerability (CVSS 7.3, wp3sixty Woo Custom Emails)
- [CVE-2023-32506](https://cve.now/CVE-2023-32506.md): WordPress Link Whisper Free plugin \<= 0.6.3 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5, Link Whisper Free)
- [CVE-2023-30490](https://cve.now/CVE-2023-30490.md): WordPress Easing Slider plugin \<= 3.0.8 - Plugin Settings Reset Vulnerability (CVSS 7.5, Matthew Ruddy Easing Slider)
- [CVE-2023-28990](https://cve.now/CVE-2023-28990.md): WordPress Viral Mag theme \<= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability (CVSS 4.3, HashThemes Viral Mag)
- [CVE-2023-27456](https://cve.now/CVE-2023-27456.md): WordPress Total theme \<= 2.1.19 - Authenticated Arbitrary Plugin Activation (CVSS 4.3, HashThemes Total)
- [CVE-2023-25988](https://cve.now/CVE-2023-25988.md): WordPress Video Gallery – YouTube Gallery plugin \<= 1.7.6 - Broken Access Control vulnerability (CVSS 7.5, Video Gallery by Total-Soft Video Gallery – YouTube Gallery)
- [CVE-2022-47429](https://cve.now/CVE-2022-47429.md): WordPress Coming Soon Landing Page and Maintenance Mode WordPress Plugin plugin \<= 2.2.0 - Broken Access Control (CVSS 5.3, 8Degree Themes Coming Soon Landing Page and Maintenance Mod…)
- [CVE-2022-44578](https://cve.now/CVE-2022-44578.md): WordPress Owl Carousel plugin \<= 0.5.3 - Broken Access Control vulnerability (CVSS 5.3, Pierre JEHAN Owl Carousel)
- [CVE-2023-22697](https://cve.now/CVE-2023-22697.md): WordPress Survey Maker plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 5.3, Survey Maker team Survey Maker)
- [CVE-2022-47594](https://cve.now/CVE-2022-47594.md): WordPress Essential Blocks for Gutenberg plugin \<= 3.8.5 - Broken Access Control (CVSS 6.5, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2022-47182](https://cve.now/CVE-2022-47182.md): WordPress APIExperts Square for WooCommerce plugin \<= 4.4.1 - Broken Access Control (CVSS 5.3, Wpexpertsio APIExperts Square for WooCommerce)
- [CVE-2022-47176](https://cve.now/CVE-2022-47176.md): WordPress Depicter Slider plugin \<= 1.9.0 - Broken Access Control vulnerability (CVSS 4.3, Depicter Slider and Popup by Averta Depicter Slider)
- [CVE-2022-47168](https://cve.now/CVE-2022-47168.md): WordPress Printful Integration for WooCommerce plugin \<= 2.2.3 - Cross Site Request Forgery (CSRF) (CVSS 4.3, Printful Integration for WooCommerce)
- [CVE-2022-46846](https://cve.now/CVE-2022-46846.md): WordPress Trending/Popular Post Slider and Widget plugin \<= 1.5.7 - Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Trending/Popular Post Sl…)
- [CVE-2022-46840](https://cve.now/CVE-2022-46840.md): WordPress JS Help Desk plugin \<= 2.7.1 - Broken Access Control (CVSS 5.4, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2022-46838](https://cve.now/CVE-2022-46838.md): WordPress JS Help Desk plugin \<= 2.7.1 - Unauthenticated Settings Change Vulnerability (CVSS 9.1, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2022-46811](https://cve.now/CVE-2022-46811.md): WordPress ALD Dropshipping and Fulfillment for AliExpress and WooCommerce plugin \<= 1.0.21 - Broken Access Control + CSRF (CVSS 4.3, VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillme…)
- [CVE-2022-46807](https://cve.now/CVE-2022-46807.md): WordPress Stock Sync for WooCommerce plugin \<= 2.3.2 - Broken Access Control (CVSS 4.3, Lauri Karisola / WP Trio Stock Sync for WooCommerce)
- [CVE-2022-46796](https://cve.now/CVE-2022-46796.md): WordPress CURCY plugin \<= 2.1.25 - Unauthenticated plugin settings change vulnerability (CVSS 6.5, VillaTheme CURCY)
- [CVE-2022-46795](https://cve.now/CVE-2022-46795.md): WordPress Print Invoice & Delivery Notes for WooCommerce plugin \<= 4.7.2 - CSRF Plugin Settings Reset vulnerability (CVSS 6.5, Tyche Softwares Print Invoice & Delivery Notes for WooComme…)
- [CVE-2022-45841](https://cve.now/CVE-2022-45841.md): WordPress Robo Gallery plugin \<= 3.2.9 - Auth. Broken Access Control vulnerability (CVSS 5.4, RoboSoft Robo Gallery)
- [CVE-2022-45840](https://cve.now/CVE-2022-45840.md): WordPress Auto Affiliate Links plugin \<= 6.2.1.5 - Unauth. Broken Access Control vulnerability (CVSS 6.5, Lucian Apostol Auto Affiliate Links)
- [CVE-2022-45826](https://cve.now/CVE-2022-45826.md): WordPress Sunshine Photo Cart plugin \<= 2.9.13 - Auth. Broken Access Control vulnerability (CVSS 5.4, WP Sunshine Sunshine Photo Cart)
- [CVE-2022-45819](https://cve.now/CVE-2022-45819.md): WordPress Popup Maker plugin \<= 1.17.1 - Broken Access Control vulnerability (CVSS 3.5, Popup Maker)
- [CVE-2022-45806](https://cve.now/CVE-2022-45806.md): WordPress Formidable Forms plugin \<= 5.5.4 - Broken Access Control vulnerability (CVSS 4.3, Strategy11 Form Builder Team Formidable Forms)
- [CVE-2022-43472](https://cve.now/CVE-2022-43472.md): WordPress eRoom plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 4.3, StylemixThemes eRoom – Zoom Meetings & Webinar)
- [CVE-2024-28980](https://cve.now/CVE-2024-28980.md): Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. (CVSS 6.5, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-47984](https://cve.now/CVE-2024-47984.md): Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. (CVSS 4.4, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-24902](https://cve.now/CVE-2024-24902.md): Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. (CVSS 6.6, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-38488](https://cve.now/CVE-2024-38488.md): Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. (CVSS 6.5, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-48007](https://cve.now/CVE-2024-48007.md): Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. (CVSS 5.3, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-11986](https://cve.now/CVE-2024-11986.md): Stored XSS in CrushFTP (CVSS 9.6, CrushFTP)
- [CVE-2024-55889](https://cve.now/CVE-2024-55889.md): phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames (CVSS 4.9, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2024-48008](https://cve.now/CVE-2024-48008.md): Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. (CVSS 5.3, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-22461](https://cve.now/CVE-2024-22461.md): Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. (CVSS 8.8, Dell RecoverPoint for Virtual Machines)
- [CVE-2024-9608](https://cve.now/CVE-2024-9608.md): MyParcel \<= 4.24.1 - Reflected Cross-Site Scripting (CVSS 6.1, richardperdaan MyParcel)
- [CVE-2024-11827](https://cve.now/CVE-2024-11827.md): Out of the Block: OpenStreetMap \<= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb\_query Shortcode (CVSS 6.4, gsarig Out of the Block: OpenStreetMap)
- [CVE-2024-21577](https://cve.now/CVE-2024-21577.md): ComfyUI-Ace-Nodes is vulnerable to Code Injection. (CVSS 10.0, hay86 ComfyUI-Ace-Nodes)
- [CVE-2024-21576](https://cve.now/CVE-2024-21576.md): ComfyUI-Bmad-Nodes is vulnerable to Code Injection. (CVSS 10.0, bmad4ever ComfyUI-Bmad-Nodes)
- [CVE-2021-32007](https://cve.now/CVE-2021-32007.md): Missing security header: Referrer-Policy URL (CVSS 3.5, Secomea GateManager)
- [CVE-2024-52066](https://cve.now/CVE-2024-52066.md): Potential stack corruption in Routing Service when using a malicious XML configuration document (CVSS 8.3, RTI Connext Professional)
- [CVE-2024-52065](https://cve.now/CVE-2024-52065.md): Potential stack buffer write overflow in Persistence Service while parsing malicious environment variable on non-Windows systems (CVSS 6.9, RTI Connext Professional)
- [CVE-2024-52064](https://cve.now/CVE-2024-52064.md): Potential stack buffer write overflow in Connext applications while parsing malicious license file (CVSS 6.9, RTI Connext Professional)
- [CVE-2024-52063](https://cve.now/CVE-2024-52063.md): Potential stack buffer write overflow in Connext applications while parsing malicious XML types document (CVSS 8.3, RTI Connext Professional)
- [CVE-2024-52062](https://cve.now/CVE-2024-52062.md): Potential stack buffer write overflow in Connext applications while parsing malicious XML types document (CVSS 6.9, RTI Connext Professional)
- [CVE-2024-52061](https://cve.now/CVE-2024-52061.md): Potential stack buffer overflow when parsing an XML type (CVSS 8.3, RTI Connext Professional)
- [CVE-2024-52060](https://cve.now/CVE-2024-52060.md): Potential stack overflow when using XML configuration file referencing environment variables (CVSS 8.3, RTI Connext Professional)
- [CVE-2024-52059](https://cve.now/CVE-2024-52059.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows Overflow Variables and Tags. (CVSS 6.9, RTI Connext Professional)
- [CVE-2024-52058](https://cve.now/CVE-2024-52058.md): Potential arbitrary command execution in System Designer while parsing malicious HTTP/REST requests (CVSS 8.6, RTI Connext Professional)
- [CVE-2024-52057](https://cve.now/CVE-2024-52057.md): Potential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files (CVSS 9.1, RTI Connext Professional)
- [CVE-2024-10783](https://cve.now/CVE-2024-10783.md): MainWP Child \<= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation (CVSS 8.1, MainWP Child – Securely Connects to the MainWP Dashboard to…)
- [CVE-2024-9290](https://cve.now/CVE-2024-9290.md): Super Backup & Clone - Migrate for WordPress \<= 2.3.3 - Unauthenticated Arbitrary File Upload (CVSS 9.8, azzaroco Super Backup & Clone - Migrate for WordPress)
- [CVE-2024-11012](https://cve.now/CVE-2024-11012.md): Notibar – Notification Bar for WordPress \<= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt\_nofi\_text (CVSS 6.3, ninjateam Notibar – Notification Bar for WordPress)
- [CVE-2024-12465](https://cve.now/CVE-2024-12465.md): Property Hive Stamp Duty Calculator \<= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, propertyhive Property Hive Stamp Duty Calculator)
- [CVE-2024-11275](https://cve.now/CVE-2024-11275.md): WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin \<= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion (CVSS 4.3, arraytics Timetics – Appointment Booking & Scheduling)
- [CVE-2024-12309](https://cve.now/CVE-2024-12309.md): Rate My Post – Star Rating Plugin by FeedbackWP \<= 4.2.4 - Unauthenticated Voting On Scheduled Posts (CVSS 5.3, properfraction Rate My Post – Star Rating Plugin by Feedbac…)
- [CVE-2024-12417](https://cve.now/CVE-2024-12417.md): Simple Link Directory \<= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, quantumcloud Simple Link Directory)
- [CVE-2024-11910](https://cve.now/CVE-2024-11910.md): WP Crowdfunding \<= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themeum WP Crowdfunding)
- [CVE-2024-12042](https://cve.now/CVE-2024-12042.md): MStore API – Create Native Android & iOS Apps On The Cloud \<= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting) (CVSS 5.4, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2024-11911](https://cve.now/CVE-2024-11911.md): WP Crowdfunding \<= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation (CVSS 4.3, themeum WP Crowdfunding)
- [CVE-2024-11754](https://cve.now/CVE-2024-11754.md): Booking System Trafft \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ameliabooking Booking System Trafft)
- [CVE-2024-12421](https://cve.now/CVE-2024-12421.md): Coupon Affiliates – Affiliate Plugin for WooCommerce \<= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting (CVSS 6.5, elliotvs Coupon Affiliates – Affiliate Plugin for WooCommer…)
- [CVE-2024-12420](https://cve.now/CVE-2024-12420.md): WPMobile.App — Android and iOS Mobile Application \<= 11.52 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, amauric WPMobile.App)
- [CVE-2024-12414](https://cve.now/CVE-2024-12414.md): Themify Store Locator \<= 1.1.9 - Cross-Site Request Forgery (CVSS 4.3, themifyme Themify Store Locator)
- [CVE-2024-11832](https://cve.now/CVE-2024-11832.md): Beaver Builder – WordPress Page Builder \<= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-10939](https://cve.now/CVE-2024-10939.md): Image Widget \< 4.4.11 - Admin+ Stored XSS (CVSS 4.8, Image Widget)
- [CVE-2024-10678](https://cve.now/CVE-2024-10678.md): Ultimate Blocks \< 3.2.4 - Contributor+ Stored XSS (CVSS 5.4, Ultimate Blocks)
- [CVE-2024-11839](https://cve.now/CVE-2024-11839.md): Insecure Deserialization via Runbooks Imports (CVSS 8.6, PlexTrac)
- [CVE-2024-11838](https://cve.now/CVE-2024-11838.md): Local File Inclusion (CVSS 8.6, PlexTrac)
- [CVE-2024-11837](https://cve.now/CVE-2024-11837.md): N1QL Injection (CVSS 8.6, PlexTrac)
- [CVE-2024-11836](https://cve.now/CVE-2024-11836.md): Server-side Request Forgery (CVSS 8.6, PlexTrac)
- [CVE-2024-11835](https://cve.now/CVE-2024-11835.md): Denial of Service (CVSS 7.0, PlexTrac)
- [CVE-2024-11834](https://cve.now/CVE-2024-11834.md): Arbitrary File Write via PTRAC Import (CVSS 8.9, PlexTrac)
- [CVE-2024-11833](https://cve.now/CVE-2024-11833.md): Arbitrary Directory Write via Runbooks Artifact Upload (CVSS 8.9, PlexTrac)
- [CVE-2024-12581](https://cve.now/CVE-2024-12581.md): Kadence Blocks \<= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-21543](https://cve.now/CVE-2024-21543.md): Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. (CVSS 5.7, djoser)
- [CVE-2024-21544](https://cve.now/CVE-2024-21544.md): Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the se (CVSS 7.7, spatie/browsershot)
- [CVE-2024-11809](https://cve.now/CVE-2024-11809.md): Primer MyData for Woocommerce \<= 4.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, primersoftware Primer MyData for Woocommerce)
- [CVE-2024-12579](https://cve.now/CVE-2024-12579.md): Minify HTML \<= 2.1.10 - - Regular Expressions Denial of Service (CVSS 5.3, teckel Minify HTML)
- [CVE-2024-12574](https://cve.now/CVE-2024-12574.md): SVG Shortcode \<= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 5.4, amrendesign SVG Shortcode)
- [CVE-2024-11767](https://cve.now/CVE-2024-11767.md): NewsmanApp \<= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, NewsmanApp)
- [CVE-2019-25221](https://cve.now/CVE-2019-25221.md): Responsive Filterable Portfolio \<=1.0.8 - Authenticated (Admin+) SQL Injection (CVSS 6.5, nik00726 Responsive Filterable Portfolio)
- [CVE-2024-12300](https://cve.now/CVE-2024-12300.md): AR for WordPress \<= 7.3 - Missing Authorization to Unauthenticated Limited File Upload (CVSS 3.7, webandprint AR for WordPress)
- [CVE-2024-12572](https://cve.now/CVE-2024-12572.md): Hello in All Languages \<= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, stathisg Hello In All Languages)
- [CVE-2024-12603](https://cve.now/CVE-2024-12603.md): A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password. (CVSS 9.8, TECNO com.transsion.applock)
- [CVE-2024-12212](https://cve.now/CVE-2024-12212.md): Horner Automation Cscape Out-of-bounds Read (CVSS 7.8, Horner Automation Cscape)
- [CVE-2024-9508](https://cve.now/CVE-2024-9508.md): Horner Automation Cscape Out-of-bounds Read (CVSS 7.8, Horner Automation Cscape)
- [CVE-2024-55918](https://cve.now/CVE-2024-55918.md): An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. (CVSS 5.3)
- [CVE-2024-55956](https://cve.now/CVE-2024-55956.md): In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.