CVEs published December 14, 2024
49 CVEs were published on December 14, 2024: 1 critical, 7 high.
- Published
- 49
- Critical
- 1
- High
- 7
- Medium
- 41
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- wpjobportal WP Job Portal – AI-Powered Recruitment System f…
- 6
- homeasap My IDX Home Search
- 2
- IBM Storage Scale
- 2
- shabti Frontend Admin by DynamiApps
- 2
- acewebx IMS Countdown
- 1
- aruphash Crafthemes Demo Import
- 1
- babo2015 Eveeno
- 1
- budiony bodi0`s Easy cache
- 1
- Bukza
- 1
- coderpress Posts and Products Views for WooCommerce
- 1
Critical 1
High 7
- CVE-2024-31891IBM Storage Scale privilege escalationIBM Storage Scale
- CVE-2024-31892IBM Storage Scale SQL injectionIBM Storage Scale
- CVE-2024-11721Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalationshabti Frontend Admin by DynamiApps
- CVE-2024-11720Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scriptingshabti Frontend Admin by DynamiApps
- CVE-2024-11711WP Job Portal <= 2.2.1 - Unauthenticated SQL Injectionwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-10646Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subjecttechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-9698Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_filesaruphash Crafthemes Demo Import
Medium, low and unrated 41
- CVE-2024-11712WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Downloadwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-11710WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injectionwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-11714WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()wpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-11713WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()wpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-11715WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalationwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2024-12446Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinggravitymaster97 PDF Generator for Posts & Pages – Export An…
- CVE-2024-12628bodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scriptingbudiony bodi0`s Easy cache
- CVE-2024-12422Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scriptingxylus Import Eventbrite Events
- CVE-2024-12459Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingGanohrs Toggle Shortcode
- CVE-2024-11752Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingbabo2015 Eveeno
- CVE-2024-12474GeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingGeoDataSource Country Region DropDown
- CVE-2024-10690Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosurerstheme2017 Shortcodes for Elementor
- CVE-2024-12501Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingkylephillips Simple Locator
- CVE-2024-11884Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinggopiplus Wp photo text slider
- CVE-2024-11888IDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingIDer Login for WordPress
- CVE-2024-11869Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptinguvstudio Buk for WordPress
- CVE-2024-11877Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpscore Cricket Live Score
- CVE-2024-12502My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinghomeasap My IDX Home Search
- CVE-2024-11894The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingtheandystratton The Permalinker
- CVE-2024-11855Koalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height ParameterKoalendar – Easy Appointment Scheduling & Booking Plugin
- CVE-2024-12447Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcodewebdeveric Get Post Content Shortcode
- CVE-2024-12523States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwssoffice21 States Map US
- CVE-2024-12458Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdevnethr Smart PopUp Blaster
- CVE-2024-12411WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scriptingonetarek WP Ad Guru – Banner ad, Responsive popup, Popup ma…
- CVE-2024-12448Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingcoderpress Posts and Products Views for WooCommerce
- CVE-2024-11883Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingConnatix Video Embed
- CVE-2024-12517WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingprontotools WooCommerce Cart Count Shortcode
- CVE-2024-11763Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingPlezi
- CVE-2024-11462Filestack Official <= 2.1.0 - Reflected Cross-Site ScriptingFilestack WP Upload
- CVE-2024-11770Post Carousel & Slider <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingtarakpatel18 Post Carousel & Slider
- CVE-2024-11095Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadVisualmodo Elements
- CVE-2024-11876Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingyoannr35 Kredeum NFTs, the easiest way to sell your NFTs di…
- CVE-2024-11759Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingBukza
- CVE-2024-11751TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingtcoder TCBD Popover
- CVE-2024-11755IMS Countdown <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingacewebx IMS Countdown
- CVE-2024-12578Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data ExposureTickera – Sell Tickets & Manage Events
- CVE-2024-11865Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinghtml5maps Tabs Maker
- CVE-2024-11867Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingpapin Companion Portfolio – Responsive Portfolio Plugin
- CVE-2024-11889My IDX Home Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinghomeasap My IDX Home Search
- CVE-2024-11873glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingglomex oEmbed
- CVE-2024-12555SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingmgplugin SIP Calculator