# CVEs published 2024-12-14

49 CVEs were published on December 14, 2024: 1 critical, 7 high. Days are UTC.

- [CVE-2024-31891](https://cve.now/CVE-2024-31891.md): IBM Storage Scale privilege escalation (CVSS 7.8, IBM Storage Scale)
- [CVE-2024-31892](https://cve.now/CVE-2024-31892.md): IBM Storage Scale SQL injection (CVSS 7.5, IBM Storage Scale)
- [CVE-2024-11721](https://cve.now/CVE-2024-11721.md): Frontend Admin by DynamiApps \<= 3.24.5 - Unauthenticated Privilege Escalation (CVSS 8.1, shabti Frontend Admin by DynamiApps)
- [CVE-2024-11720](https://cve.now/CVE-2024-11720.md): Frontend Admin by DynamiApps \<= 3.24.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, shabti Frontend Admin by DynamiApps)
- [CVE-2024-11712](https://cve.now/CVE-2024-11712.md): WP Job Portal \<= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download (CVSS 5.3, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-11710](https://cve.now/CVE-2024-11710.md): WP Job Portal \<= 2.2.2 - Authenticated (Admin+) SQL Injection (CVSS 4.9, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-11711](https://cve.now/CVE-2024-11711.md): WP Job Portal \<= 2.2.1 - Unauthenticated SQL Injection (CVSS 7.5, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-11714](https://cve.now/CVE-2024-11714.md): WP Job Portal \<= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox() (CVSS 4.9, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-11713](https://cve.now/CVE-2024-11713.md): WP Job Portal \<= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal\_deactivate() (CVSS 4.9, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-11715](https://cve.now/CVE-2024-11715.md): WP Job Portal \<= 2.2.2 - Missing Authorization to Limited Privilege Escalation (CVSS 4.8, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-12446](https://cve.now/CVE-2024-12446.md): Post to Pdf \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gravitymaster97 PDF Generator for Posts & Pages – Export An…)
- [CVE-2024-12628](https://cve.now/CVE-2024-12628.md): bodi0’s Easy Cache \<= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, budiony bodi0\`s Easy cache)
- [CVE-2024-12422](https://cve.now/CVE-2024-12422.md): Import Eventbrite Events \<= 1.7.4 - Reflected Cross-Site Scripting (CVSS 6.1, xylus Import Eventbrite Events)
- [CVE-2024-12459](https://cve.now/CVE-2024-12459.md): Ganohrs Toggle Shortcode \<= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Ganohrs Toggle Shortcode)
- [CVE-2024-11752](https://cve.now/CVE-2024-11752.md): Eveeno \<= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, babo2015 Eveeno)
- [CVE-2024-12474](https://cve.now/CVE-2024-12474.md): GeoDataSource Country Region DropDown \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, GeoDataSource Country Region DropDown)
- [CVE-2024-10690](https://cve.now/CVE-2024-10690.md): Shortcodes for Elementor \<= 1.0.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, rstheme2017 Shortcodes for Elementor)
- [CVE-2024-10646](https://cve.now/CVE-2024-10646.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject (CVSS 7.2, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-12501](https://cve.now/CVE-2024-12501.md): Simple Locator \<= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kylephillips Simple Locator)
- [CVE-2024-11884](https://cve.now/CVE-2024-11884.md): Wp photo text slider 50 \<= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gopiplus Wp photo text slider)
- [CVE-2024-9698](https://cve.now/CVE-2024-9698.md): Crafthemes Demo Import \<= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process\_uploaded\_files (CVSS 7.2, aruphash Crafthemes Demo Import)
- [CVE-2024-11888](https://cve.now/CVE-2024-11888.md): IDer Login for WordPress \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, IDer Login for WordPress)
- [CVE-2024-11869](https://cve.now/CVE-2024-11869.md): Buk for WordPress \<= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, uvstudio Buk for WordPress)
- [CVE-2024-11877](https://cve.now/CVE-2024-11877.md): Cricket Live Score \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpscore Cricket Live Score)
- [CVE-2024-12502](https://cve.now/CVE-2024-12502.md): My IDX Home Search \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, homeasap My IDX Home Search)
- [CVE-2024-11894](https://cve.now/CVE-2024-11894.md): The Permalinker \<= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, theandystratton The Permalinker)
- [CVE-2024-11855](https://cve.now/CVE-2024-11855.md): Koalendar – Events & Appointments Booking Calendar \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter (CVSS 6.4, Koalendar – Easy Appointment Scheduling & Booking Plugin)
- [CVE-2024-12447](https://cve.now/CVE-2024-12447.md): Get Post Content Shortcode \<= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post\_content Shortcode (CVSS 4.3, webdeveric Get Post Content Shortcode)
- [CVE-2024-12523](https://cve.now/CVE-2024-12523.md): States Map US \<= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wssoffice21 States Map US)
- [CVE-2024-12458](https://cve.now/CVE-2024-12458.md): Smart PopUp Blaster \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, devnethr Smart PopUp Blaster)
- [CVE-2024-12411](https://cve.now/CVE-2024-12411.md): WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More \<= 2.5.4 - Reflected Cross-Site Scripting (CVSS 6.1, onetarek WP Ad Guru – Banner ad, Responsive popup, Popup ma…)
- [CVE-2024-12448](https://cve.now/CVE-2024-12448.md): Posts and Products Views for WooCommerce \<= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, coderpress Posts and Products Views for WooCommerce)
- [CVE-2024-11883](https://cve.now/CVE-2024-11883.md): Connatix Video Embed \<= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Connatix Video Embed)
- [CVE-2024-12517](https://cve.now/CVE-2024-12517.md): WooCommerce Cart Count Shortcode \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, prontotools WooCommerce Cart Count Shortcode)
- [CVE-2024-11763](https://cve.now/CVE-2024-11763.md): Plezi \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Plezi)
- [CVE-2024-11462](https://cve.now/CVE-2024-11462.md): Filestack Official \<= 2.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, Filestack WP Upload)
- [CVE-2024-11770](https://cve.now/CVE-2024-11770.md): Post Carousel & Slider \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tarakpatel18 Post Carousel & Slider)
- [CVE-2024-11095](https://cve.now/CVE-2024-11095.md): Visualmodo Elements \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, Visualmodo Elements)
- [CVE-2024-11876](https://cve.now/CVE-2024-11876.md): Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site \<= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, yoannr35 Kredeum NFTs, the easiest way to sell your NFTs di…)
- [CVE-2024-11759](https://cve.now/CVE-2024-11759.md): Bukza \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Bukza)
- [CVE-2024-11751](https://cve.now/CVE-2024-11751.md): TCBD Popover \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tcoder TCBD Popover)
- [CVE-2024-11755](https://cve.now/CVE-2024-11755.md): IMS Countdown \<= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, acewebx IMS Countdown)
- [CVE-2024-12578](https://cve.now/CVE-2024-12578.md): Tickera – WordPress Event Ticketing \<= 3.5.4.8 - Unauthenticated Customer Data Exposure (CVSS 5.3, Tickera – Sell Tickets & Manage Events)
- [CVE-2024-11865](https://cve.now/CVE-2024-11865.md): Tabs Maker \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, html5maps Tabs Maker)
- [CVE-2024-11867](https://cve.now/CVE-2024-11867.md): Companion Portfolio – Responsive Portfolio Plugin \<= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, papin Companion Portfolio – Responsive Portfolio Plugin)
- [CVE-2024-11889](https://cve.now/CVE-2024-11889.md): My IDX Home Search \<= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, homeasap My IDX Home Search)
- [CVE-2024-11873](https://cve.now/CVE-2024-11873.md): glomex oEmbed \<= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, glomex oEmbed)
- [CVE-2024-12555](https://cve.now/CVE-2024-12555.md): SIP Calculator \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, mgplugin SIP Calculator)
- [CVE-2023-29476](https://cve.now/CVE-2023-29476.md): In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.