# CVEs published 2024-12-16

207 CVEs were published on December 16, 2024: 26 critical, 104 high. Days are UTC.

- [CVE-2024-11906](https://cve.now/CVE-2024-11906.md): TPG Get Posts \<= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cswaim TPG Get Posts)
- [CVE-2024-11905](https://cve.now/CVE-2024-11905.md): Animated Counters \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, freeben Animated Counters)
- [CVE-2024-11902](https://cve.now/CVE-2024-11902.md): Slope Widgets \<= 4.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, slopeit Slope Widgets)
- [CVE-2024-11900](https://cve.now/CVE-2024-11900.md): Portfolio – Filterable Masonry Portfolio Gallery for Professionals \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, logichunt Portfolio – Filterable Masonry Portfolio Gallery…)
- [CVE-2024-12443](https://cve.now/CVE-2024-12443.md): CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout \<= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, crmperks CRM Perks – WordPress HelpDesk Integration – Zende…)
- [CVE-2024-56017](https://cve.now/CVE-2024-56017.md): WordPress Stop Registration Spam Plugin \<= 1.23 - CSRF to Stored XSS vulnerability (CVSS 7.1, Tom Royal Stop Registration Spam)
- [CVE-2024-35230](https://cve.now/CVE-2024-35230.md): Welcome and About GeoServer pages communicate version and revision information (CVSS 5.3, geoserver · org.geoserver.web:gs-web-app +1)
- [CVE-2024-55951](https://cve.now/CVE-2024-55951.md): Metabase sandboxed users could see filter values from other sandboxed users (CVSS 4.8, metabase)
- [CVE-2024-55949](https://cve.now/CVE-2024-55949.md): Privilege escalation in IAM import API in MinIO (CVSS 9.3, minio · github.com/minio/minio)
- [CVE-2024-12667](https://cve.now/CVE-2024-12667.md): InvoicePlane view session expiration (CVSS 6.3, InvoicePlane)
- [CVE-2024-12666](https://cve.now/CVE-2024-12666.md): ClassCMS User Management Page admin insufficient privileges (CVSS 5.1, ClassCMS)
- [CVE-2024-12665](https://cve.now/CVE-2024-12665.md): ruifang-tech Rebuild Task Comment Attachment Upload cross site scripting (CVSS 5.3, ruifang-tech Rebuild)
- [CVE-2024-12664](https://cve.now/CVE-2024-12664.md): ruifang-tech Rebuild Project Task Comment cross site scripting (CVSS 5.3, ruifang-tech Rebuild)
- [CVE-2024-12687](https://cve.now/CVE-2024-12687.md): Insecure YAML Deserialization (CVSS 8.6, PlexTrac)
- [CVE-2024-12663](https://cve.now/CVE-2024-12663.md): funnyzpc Mee-Admin Login login observable response discrepancy (CVSS 6.3, funnyzpc Mee-Admin)
- [CVE-2024-12662](https://cve.now/CVE-2024-12662.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E040 null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-12661](https://cve.now/CVE-2024-12661.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E024 null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-12660](https://cve.now/CVE-2024-12660.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E018 null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-12659](https://cve.now/CVE-2024-12659.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E004 null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-12658](https://cve.now/CVE-2024-12658.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E01C null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-8058](https://cve.now/CVE-2024-8058.md): An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary (CVSS 7.6, Lenovo FileZ Client)
- [CVE-2024-6001](https://cve.now/CVE-2024-6001.md): An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an up (CVSS 8.1, Lenovo Accessories and Display Manager)
- [CVE-2024-4762](https://cve.now/CVE-2024-4762.md): An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to esc (CVSS 7.8, Lenovo Accessories and Display Manager · Lenovo Display Con…)
- [CVE-2024-11144](https://cve.now/CVE-2024-11144.md): Race Condition with LightFTP (CVSS 7.5, LightFTP)
- [CVE-2024-12657](https://cve.now/CVE-2024-12657.md): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E000 null pointer dereference (CVSS 6.8, IObit Advanced SystemCare Utimate)
- [CVE-2024-12656](https://cve.now/CVE-2024-12656.md): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220448 null pointer dereference (CVSS 6.8, FabulaTech USB over Network)
- [CVE-2024-10095](https://cve.now/CVE-2024-10095.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 8.4, Progress Software Telerik UI for WPF)
- [CVE-2024-12655](https://cve.now/CVE-2024-12655.md): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference (CVSS 6.8, FabulaTech USB over Network)
- [CVE-2024-11358](https://cve.now/CVE-2024-11358.md): Insecure Android File Provider Paths (CVSS 5.7, Mattermost)
- [CVE-2024-12654](https://cve.now/CVE-2024-12654.md): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220408 null pointer dereference (CVSS 6.8, FabulaTech USB over Network)
- [CVE-2024-54357](https://cve.now/CVE-2024-54357.md): WordPress Avada theme \<= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThemeFusion Avada)
- [CVE-2024-54376](https://cve.now/CVE-2024-54376.md): WordPress EazyDocs plugin \<= 2.8.0 - Local File Inclusion vulnerability (CVSS 7.5, Spider Themes EazyDocs)
- [CVE-2024-56003](https://cve.now/CVE-2024-56003.md): WordPress Caldera SMTP Mailer plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 4.3, David Cramer Caldera SMTP Mailer)
- [CVE-2024-55999](https://cve.now/CVE-2024-55999.md): WordPress XML Multilanguage Sitemap Generator plugin \<= 2.0.6 - Broken Access Control vulnerability (CVSS 5.3, Marco Giannini XML Multilanguage Sitemap Generator)
- [CVE-2024-54348](https://cve.now/CVE-2024-54348.md): WordPress Brandy theme \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, yaycommerce Brand)
- [CVE-2024-54285](https://cve.now/CVE-2024-54285.md): WordPress SeedProd Pro plugin \<= 6.18.10 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, SeedProd Pro)
- [CVE-2024-54284](https://cve.now/CVE-2024-54284.md): WordPress SeedProd Pro plugin \<= 6.18.10 - SQL Injection vulnerability (CVSS 7.6, SeedProd Pro)
- [CVE-2024-54283](https://cve.now/CVE-2024-54283.md): WordPress SeedProd Pro plugin \<= 6.18.10 - SQL Injection vulnerability (CVSS 7.6, SeedProd Pro)
- [CVE-2024-54280](https://cve.now/CVE-2024-54280.md): WordPress WPBookit plugin \<= 1.6.0 - SQL Injection vulnerability (CVSS 9.3, Iqonic Design WPBookit)
- [CVE-2024-54279](https://cve.now/CVE-2024-54279.md): WordPress WP-NERD Toolkit plugin \<= 1.1 - Sensitive Data Exposure vulnerability (CVSS 7.5, Tobias Keller WP-NERD Toolkit)
- [CVE-2024-54257](https://cve.now/CVE-2024-54257.md): WordPress tydskrif theme \<= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Molefed tydskrif)
- [CVE-2024-54249](https://cve.now/CVE-2024-54249.md): WordPress Advanced Options Editor plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jules Colle Advanced Options Editor)
- [CVE-2024-43234](https://cve.now/CVE-2024-43234.md): WordPress Woffice theme \<= 5.4.14 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, WofficeIO Woffice)
- [CVE-2024-12653](https://cve.now/CVE-2024-12653.md): FabulaTech USB over Network IOCT ftusbbus2.sys 0x22040C null pointer dereference (CVSS 6.8, FabulaTech USB over Network)
- [CVE-2024-54229](https://cve.now/CVE-2024-54229.md): WordPress SV100 Companion plugin \<= 2.0.02 - Privilege Escalation vulnerability (CVSS 9.8, straightvisions SV100 Companion)
- [CVE-2024-12092](https://cve.now/CVE-2024-12092.md): Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-12091](https://cve.now/CVE-2024-12091.md): Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-12090](https://cve.now/CVE-2024-12090.md): Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-12089](https://cve.now/CVE-2024-12089.md): Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-49775](https://cve.now/CVE-2024-49775.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2501.0001), Opcenter Intelligence (All versions \< V250 (CVSS 9.8, Siemens Opcenter Execution Foundation · Siemens Opcenter… +5)
- [CVE-2024-37251](https://cve.now/CVE-2024-37251.md): WordPress Advanced Custom Fields Pro plugin \< 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, WPENGINE Advanced Custom Fields PRO)
- [CVE-2024-12668](https://cve.now/CVE-2024-12668.md): Velocidex WinPmem Out of Bounds Write Vulnerability (CVSS 8.2, Velocidex WinPmem)
- [CVE-2024-10972](https://cve.now/CVE-2024-10972.md): WinPmem Improper Input Validation vulnerability (CVSS 7.3, Velocidex WinPmem)
- [CVE-2024-56015](https://cve.now/CVE-2024-56015.md): WordPress Tidy Up Plugin \<= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerability (CVSS 7.1, John Godley Tidy Up)
- [CVE-2024-54354](https://cve.now/CVE-2024-54354.md): WordPress Termin-Kalender plugin \<= 0.99.47 - Broken Access Control vulnerability (CVSS 6.5, beat.k Termin-Kalender)
- [CVE-2024-54358](https://cve.now/CVE-2024-54358.md): WordPress 3D Avatar User Profile plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Enrico Cantori 3D Avatar User Profile)
- [CVE-2024-54359](https://cve.now/CVE-2024-54359.md): WordPress Banner System plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 8.2, Saul Morales Pacheco Banner System)
- [CVE-2024-54361](https://cve.now/CVE-2024-54361.md): WordPress Instant Appointment plugin \<= 1.2 - SQL Injection vulnerability (CVSS 9.3, tenteeglobal Instant Appointment)
- [CVE-2024-54363](https://cve.now/CVE-2024-54363.md): WordPress Wp NssUser Register plugin \<= 1.0.0 - Privilege Escalation vulnerability (CVSS 9.8, saiful.total Wp NssUser Register)
- [CVE-2024-54364](https://cve.now/CVE-2024-54364.md): WordPress Feedpress Generator plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, spartac Feedpress Generator)
- [CVE-2024-54365](https://cve.now/CVE-2024-54365.md): WordPress KH Easy User Settings plugin \<= 1.0.0 - Privilege Escalation vulnerability (CVSS 8.8, Knowhalim KH Easy User Settings)
- [CVE-2024-54367](https://cve.now/CVE-2024-54367.md): WordPress ForumWP plugin \<= 2.1.0 - PHP Object Injection vulnerability (CVSS 9.8, Ultimate Member ForumWP)
- [CVE-2024-54368](https://cve.now/CVE-2024-54368.md): WordPress GitSync plugin \<= 1.1.0 - CSRF to Remote Code Execution vulnerability (CVSS 9.6, rubengarzajr GitSync)
- [CVE-2024-54369](https://cve.now/CVE-2024-54369.md): WordPress Zita Site Builder plugin \<= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability (CVSS 9.1, ThemeHunk Zita Site Builder)
- [CVE-2024-54370](https://cve.now/CVE-2024-54370.md): WordPress Video & Photo Gallery for Ultimate Member plugin \<= 1.1.0 - Arbitrary File Upload vulnerability (CVSS 9.9, SuitePlugins Video & Photo Gallery for Ultimate Member)
- [CVE-2024-54374](https://cve.now/CVE-2024-54374.md): WordPress Sogrid plugin \<= 1.5.6 - Local File Inclusion vulnerability (CVSS 7.5, Sabri Sogrid)
- [CVE-2024-54375](https://cve.now/CVE-2024-54375.md): WordPress Woolook plugin \<= 1.7.0 - Local File Inclusion vulnerability (CVSS 7.5, Sabri Woolook)
- [CVE-2024-54378](https://cve.now/CVE-2024-54378.md): WordPress Quietly Insights plugin \<= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, Quietly Insights)
- [CVE-2024-54379](https://cve.now/CVE-2024-54379.md): WordPress Minterpress plugin \<= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, blokhauswp Minterpress)
- [CVE-2024-54380](https://cve.now/CVE-2024-54380.md): WordPress WP Cookies Enabler plugin \<= 1.0.1 - Local File Inclusion vulnerability (CVSS 7.5, Filippo Bodei WP Cookies Enabler)
- [CVE-2024-54382](https://cve.now/CVE-2024-54382.md): WordPress Bold Page Builder plugin \<= 5.1.5 - Path Traversal vulnerability (CVSS 4.9, boldthemes Bold Page Builder)
- [CVE-2024-54385](https://cve.now/CVE-2024-54385.md): WordPress Radio Player plugin \<= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, princeahmed Radio Player)
- [CVE-2024-54387](https://cve.now/CVE-2024-54387.md): WordPress Posts Date Ranges plugin \<= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jaytesh Barange Posts Date Ranges)
- [CVE-2024-54390](https://cve.now/CVE-2024-54390.md): WordPress TagGator plugin \<= 1.54 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bouzid Nazim Zitouni TagGator)
- [CVE-2024-54395](https://cve.now/CVE-2024-54395.md): WordPress Increase Sociability plugin \<= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, preblogging Increase Sociability)
- [CVE-2024-54403](https://cve.now/CVE-2024-54403.md): WordPress Visual Recent Posts plugin \<= 1.2.3 - Reflected Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, oktoberfive Visual Recent Posts)
- [CVE-2024-54406](https://cve.now/CVE-2024-54406.md): WordPress Comments On Feed plugin \<= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, moallemi Comments On Feed)
- [CVE-2024-54422](https://cve.now/CVE-2024-54422.md): WordPress Evernote Sync plugin \<= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, tgw365 Evernote Sync)
- [CVE-2024-55972](https://cve.now/CVE-2024-55972.md): WordPress eTemplates plugin \<= 0.2.1 - SQL Injection vulnerability (CVSS 9.3, chriscarvache eTemplates)
- [CVE-2024-55973](https://cve.now/CVE-2024-55973.md): WordPress TSB Occasion Editor plugin \<= 1.2.1 - SQL Injection vulnerability (CVSS 8.5, rnystrom TSB Occasion Editor)
- [CVE-2024-55974](https://cve.now/CVE-2024-55974.md): WordPress Mimoos plugin \<= 1.2 - SQL Injection vulnerability (CVSS 8.5, Martí Batlles Martinez Mimoos)
- [CVE-2024-55976](https://cve.now/CVE-2024-55976.md): WordPress Critical Site Intel plugin \<= 1.0 - SQL Injection vulnerability (CVSS 9.3, mikeleembruggen Critical Site Intel)
- [CVE-2024-55977](https://cve.now/CVE-2024-55977.md): WordPress LaunchPage.app Importer plugin \<= 1.1 - SQL Injection vulnerability (CVSS 9.3, BinaryCarpenter LaunchPage.app Importer)
- [CVE-2024-55978](https://cve.now/CVE-2024-55978.md): WordPress Code Generator Pro plugin \<= 1.2 - SQL Injection vulnerability (CVSS 9.3, WalletStation Code Generator Pro)
- [CVE-2024-55979](https://cve.now/CVE-2024-55979.md): WordPress Wr Age Verification plugin \<= 2.0.0 - SQL Injection vulnerability (CVSS 8.5, robindkumar Wr Age Verification)
- [CVE-2024-55980](https://cve.now/CVE-2024-55980.md): WordPress Wr Age Verification plugin \<= 2.0.0 - SQL Injection vulnerability (CVSS 9.3, robindkumar Wr Age Verification)
- [CVE-2024-55981](https://cve.now/CVE-2024-55981.md): WordPress Nabz Image Gallery plugin \<= v1.00 - SQL Injection vulnerability (CVSS 9.3, Nabajit Roy Nabz Image Gallery)
- [CVE-2024-55982](https://cve.now/CVE-2024-55982.md): WordPress Share Buttons – Social Media plugin \<= 1.0.2 - SQL Injection vulnerability (CVSS 9.3, richteam Share Buttons – Social Media)
- [CVE-2024-55986](https://cve.now/CVE-2024-55986.md): WordPress Service plugin \<= 1.0.4 - SQL Injection vulnerability (CVSS 8.5, tiny13 Service)
- [CVE-2024-55987](https://cve.now/CVE-2024-55987.md): WordPress Advanced What should we write next about plugin \<= 1.0.3 - SQL Injection vulnerability (CVSS 8.5, Ritesh Sanap Advanced What should we write next about)
- [CVE-2024-55988](https://cve.now/CVE-2024-55988.md): WordPress Navayan CSV Export Plugin \<= 1.0.9 - SQL Injection vulnerability (CVSS 9.3, Amol Nirmala Waman Navayan CSV Export)
- [CVE-2024-55996](https://cve.now/CVE-2024-55996.md): WordPress Payment gateway per Product for WooCommerce plugin \<= 3.5.6 - Broken Access Control vulnerability (CVSS 6.1, Dreamfox Media Payment gateway per Product for Woocommerce)
- [CVE-2024-56013](https://cve.now/CVE-2024-56013.md): WordPress Wovax IDX plugin \<= 1.2.2 - Account Takeover vulnerability (CVSS 8.8, Wovax IDX)
- [CVE-2024-54384](https://cve.now/CVE-2024-54384.md): WordPress Falcon – WordPress Optimizations & Tweaks plugin \<= 2.8.3 - Broken Access Control vulnerability (CVSS 4.3, Anh Tran Falcon – WordPress Optimizations & Tweaks)
- [CVE-2024-54417](https://cve.now/CVE-2024-54417.md): WordPress PixProof plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 5.3, pixelgrade PixProof)
- [CVE-2024-55992](https://cve.now/CVE-2024-55992.md): WordPress WooCommerce Basic Ordernumbers plugin \<= 1.4.4 - Broken Access Control vulnerability (CVSS 5.4, Open Tools WooCommerce Basic Ordernumbers)
- [CVE-2024-55993](https://cve.now/CVE-2024-55993.md): WordPress Job Board Manager plugin \<= 2.1.61 - Broken Access Control vulnerability (CVSS 5.3, PickPlugins Job Board Manager)
- [CVE-2024-55994](https://cve.now/CVE-2024-55994.md): WordPress 畅言评论系统 plugin \<= 2.0.5 - Broken Access Control vulnerability (CVSS 4.3, sohu 畅言评论系统)
- [CVE-2024-56001](https://cve.now/CVE-2024-56001.md): WordPress Ksher plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 6.5, ksher thailand Ksher)
- [CVE-2024-56007](https://cve.now/CVE-2024-56007.md): WordPress Leader plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 4.3, leader codes Leader)
- [CVE-2024-56009](https://cve.now/CVE-2024-56009.md): WordPress Spreadr Woocommerce plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 5.3, Spreadr Woocommerce)
- [CVE-2024-54360](https://cve.now/CVE-2024-54360.md): WordPress Gutensee plugin \<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, premila Gutensee)
- [CVE-2024-54441](https://cve.now/CVE-2024-54441.md): WordPress Utech World Time Plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Meini Utech World Time)
- [CVE-2024-54442](https://cve.now/CVE-2024-54442.md): WordPress Better WP Login Page plugin \<= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, cortesfrau Better WP Login Page)
- [CVE-2024-54443](https://cve.now/CVE-2024-54443.md): WordPress Advanced Data Table For Elementor plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PluginsCafe Advanced Data Table For Elementor)
- [CVE-2024-56011](https://cve.now/CVE-2024-56011.md): WordPress Responsive Google Maps | by imbaa plugin \<= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ilja Zaglov Responsive Google Maps | by imbaa)
- [CVE-2024-54331](https://cve.now/CVE-2024-54331.md): WordPress I Plant A Tree plugin \<= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Micha I Plant A Tree)
- [CVE-2024-54352](https://cve.now/CVE-2024-54352.md): WordPress Sogrid plugin \<= 1.5.2 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, Sabri Sogrid)
- [CVE-2024-54355](https://cve.now/CVE-2024-54355.md): WordPress WP Mailster plugin \<= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, brandtoss WP Mailster)
- [CVE-2024-54356](https://cve.now/CVE-2024-54356.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin \<= 4.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-54372](https://cve.now/CVE-2024-54372.md): WordPress Insertify plugin \<= 1.1.4 - CSRF to Remote Code Execution vulnerability (CVSS 9.6, Sourov Amin Insertify)
- [CVE-2024-54396](https://cve.now/CVE-2024-54396.md): WordPress Bet sport Free plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, elmervillanueva Bet sport Free)
- [CVE-2024-54418](https://cve.now/CVE-2024-54418.md): WordPress DTC Documents plugin \<= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Diversified Technology DTC Documents)
- [CVE-2024-54419](https://cve.now/CVE-2024-54419.md): WordPress Ui Slider Filter By Price plugin \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, chenyenming Ui Slider Filter By Price)
- [CVE-2024-56005](https://cve.now/CVE-2024-56005.md): WordPress Posti Shipping Plugin \<= 3.10.3 - CSRF to Settings Change vulnerability (CVSS 6.5, Posti Shipping)
- [CVE-2024-54332](https://cve.now/CVE-2024-54332.md): WordPress WP Currency Exchange Rates plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, WPFactory WP Currency Exchange Rates)
- [CVE-2024-54353](https://cve.now/CVE-2024-54353.md): WordPress Hack-Info plugin \<= 3.17 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpgear Hack-Info)
- [CVE-2024-54386](https://cve.now/CVE-2024-54386.md): WordPress Push Monkey Pro plugin \<= 3.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, pushmonkey Push Monkey Pro – Web Push Notifications and Woo…)
- [CVE-2024-54388](https://cve.now/CVE-2024-54388.md): WordPress Multiple Admin Emails plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Phuc Pham Multiple Admin Emails)
- [CVE-2024-54389](https://cve.now/CVE-2024-54389.md): WordPress addWeather plugin \<= 2.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Eduardo addWeather)
- [CVE-2024-54391](https://cve.now/CVE-2024-54391.md): WordPress WordPress Filter plugin \<= 1.4.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, mattwalters WordPress Filter)
- [CVE-2024-54392](https://cve.now/CVE-2024-54392.md): WordPress WP微信机器人 plugin \<= 5.3.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, midoks WP微信机器人)
- [CVE-2024-54393](https://cve.now/CVE-2024-54393.md): WordPress WP Fiddle plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sheikh Heera WP Fiddle)
- [CVE-2024-54394](https://cve.now/CVE-2024-54394.md): WordPress Mandrill WP plugin \<= 1.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, khubbaib Mandrill WP)
- [CVE-2024-54397](https://cve.now/CVE-2024-54397.md): WordPress Go Animate plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, antonio.gocaj Go Animate)
- [CVE-2024-54398](https://cve.now/CVE-2024-54398.md): WordPress Flaming Forms plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, jcaruso001 Flaming Forms)
- [CVE-2024-54399](https://cve.now/CVE-2024-54399.md): WordPress CRUDLab Google Plus Button plugin \<= 1.0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, CRUDLab Google Plus Button)
- [CVE-2024-54400](https://cve.now/CVE-2024-54400.md): WordPress AppMaps plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, meloniq AppMaps)
- [CVE-2024-54401](https://cve.now/CVE-2024-54401.md): WordPress Advanced Fancybox plugin \<= 1.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ciprian Turcu Advanced Fancybox)
- [CVE-2024-54402](https://cve.now/CVE-2024-54402.md): WordPress Arabic Webfonts plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 4.3, Mohamed Abd Elhalim Arabic Webfonts)
- [CVE-2024-54404](https://cve.now/CVE-2024-54404.md): WordPress MDC Comment Toolbar plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Nazmul Ahsan MDC Comment Toolbar)
- [CVE-2024-54405](https://cve.now/CVE-2024-54405.md): WordPress ECT Social Share plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, etemplates ECT Social Share)
- [CVE-2024-54407](https://cve.now/CVE-2024-54407.md): WordPress CK and SyntaxHighlighter plugin \<= 3.4.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, a328496647 CK and SyntaxHighlighter)
- [CVE-2024-54408](https://cve.now/CVE-2024-54408.md): WordPress Youtube Video Grid plugin \<= 1.9 - CSRF to Settings Change vulnerability (CVSS 6.5, codehandling Youtube Video Grid)
- [CVE-2024-54409](https://cve.now/CVE-2024-54409.md): WordPress XPD Reduce Image Filesize plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, fzmaster XPD Reduce Image Filesize)
- [CVE-2024-54410](https://cve.now/CVE-2024-54410.md): WordPress SOPA Blackout plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, eagerterrier SOPA Blackout)
- [CVE-2024-54411](https://cve.now/CVE-2024-54411.md): WordPress WP Controller plugin \<= 3.2.0 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, hosting.io WP Controller)
- [CVE-2024-54412](https://cve.now/CVE-2024-54412.md): WordPress ECT Product Carousel plugin \<= 1.9 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, etemplates ECT Product Carousel)
- [CVE-2024-54413](https://cve.now/CVE-2024-54413.md): WordPress Display Future Posts plugin \<= 0.2.3 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, brandt-net Display Future Posts)
- [CVE-2024-54414](https://cve.now/CVE-2024-54414.md): WordPress Geoportail Shortcode plugin \<= 2.4.4 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, geoWP Geoportail Shortcode)
- [CVE-2024-54415](https://cve.now/CVE-2024-54415.md): WordPress WP-HideThat plugin \<= 1.2 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, cconoly WP-HideThat)
- [CVE-2024-54416](https://cve.now/CVE-2024-54416.md): WordPress Wp Login with Ajax plugin \<= 0.6 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Navdeep Wp Login with Ajax)
- [CVE-2024-54420](https://cve.now/CVE-2024-54420.md): WordPress Metrika plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Aleksandr Novikov Metrika)
- [CVE-2024-54421](https://cve.now/CVE-2024-54421.md): WordPress Floating Video Player plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, Sanjay\_Negi Floating Video Player)
- [CVE-2024-54423](https://cve.now/CVE-2024-54423.md): WordPress Social Media Sharing plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jesse Overright Social Media Sharing)
- [CVE-2024-54424](https://cve.now/CVE-2024-54424.md): WordPress Like in Vk.com plugin \<= 0.5.2 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, ilya\_compman Like in Vk.com)
- [CVE-2024-54425](https://cve.now/CVE-2024-54425.md): WordPress LionScripts: Site Maintenance plugin \<= 2.1 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, LionScripts.com LionScripts: Site Maintenance & Noindex Nof…)
- [CVE-2024-54426](https://cve.now/CVE-2024-54426.md): WordPress LeaderBoard Plugin plugin \<= 1.2.4 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, crossfitatgg LeaderBoard Plugin)
- [CVE-2024-54427](https://cve.now/CVE-2024-54427.md): WordPress Category of Posts plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ljmacphee Category of Posts)
- [CVE-2024-54428](https://cve.now/CVE-2024-54428.md): WordPress Add image to Post plugin \<= 0.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, onigetoc Add image to Post)
- [CVE-2024-54429](https://cve.now/CVE-2024-54429.md): WordPress Aphorismus plugin \<= 1.2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ivan-ovsyannikov Aphorismus)
- [CVE-2024-54430](https://cve.now/CVE-2024-54430.md): WordPress EELV Newsletter plugin \<= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Europe Ecologie Les Verts EELV Newsletter)
- [CVE-2024-54431](https://cve.now/CVE-2024-54431.md): WordPress Admin Customization plugin \<= 2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, phpdevp Admin Customization)
- [CVE-2024-54432](https://cve.now/CVE-2024-54432.md): WordPress WP Flipkart Importer plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Shambhu Patnaik WP Flipkart Importer)
- [CVE-2024-54433](https://cve.now/CVE-2024-54433.md): WordPress Simple Booking – Widget plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Marcel CL Simple Booking Widget)
- [CVE-2024-54434](https://cve.now/CVE-2024-54434.md): WordPress phZoom plugin \<= 1.2.92 - CSRF to Stored XSS vulnerability (CVSS 7.1, BenJemin phZoom)
- [CVE-2024-54435](https://cve.now/CVE-2024-54435.md): WordPress Onlywire Multi Autosubmitter plugin \<= 1.2.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Thomas Hoefter Onlywire Multi Autosubmitter)
- [CVE-2024-54436](https://cve.now/CVE-2024-54436.md): WordPress Jet Footer Code plugin \<= 1.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, milordk Jet Footer Code)
- [CVE-2024-54437](https://cve.now/CVE-2024-54437.md): WordPress jCarousel for WordPress plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, koolkatwebdesigns jCarousel)
- [CVE-2024-54438](https://cve.now/CVE-2024-54438.md): WordPress Gaxx Keywords plugin \<= 0.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Gaxx Keywords)
- [CVE-2024-54439](https://cve.now/CVE-2024-54439.md): WordPress Amazon Product Price plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Alok Tiwari Amazon Product Price)
- [CVE-2024-54440](https://cve.now/CVE-2024-54440.md): WordPress WP-Ban-User plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, blueskyy WP-Ban-User)
- [CVE-2024-56012](https://cve.now/CVE-2024-56012.md): WordPress Flash News / Post (Responsive) plugin \<= 4.1 - CSRF to Privilege Escalation vulnerability (CVSS 9.8, lizeipe Flash News / Post)
- [CVE-2024-55989](https://cve.now/CVE-2024-55989.md): WordPress WP Simple Pay Lite Manager Plugin \<= 1.4 - SQL Injection vulnerability (CVSS 7.6, Kyle M Brown WP Simple Pay Lite Manager)
- [CVE-2024-55990](https://cve.now/CVE-2024-55990.md): WordPress Mollie for Contact Form 7 plugin \<= 5.0.0 - SQL Injection vulnerability (CVSS 7.6, tsjippy Mollie for Contact Form)
- [CVE-2024-54373](https://cve.now/CVE-2024-54373.md): WordPress EduAdmin Booking plugin \<= 5.2.0 - Local File Inclusion vulnerability (CVSS 7.5, Chris Gardenberg EduAdmin Booking)
- [CVE-2024-55998](https://cve.now/CVE-2024-55998.md): WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin \<= 1.36 - Settings Change vulnerability (CVSS 5.4, Eric Sloan Popup Surveys & Polls for WordPress)
- [CVE-2024-56004](https://cve.now/CVE-2024-56004.md): WordPress Easy Site Importer plugin \<= 1.0.1 - Settings Change vulnerability (CVSS 5.4, awfowler Easy Site Importer)
- [CVE-2024-54366](https://cve.now/CVE-2024-54366.md): WordPress Vimeography plugin \<= 2.4.4 - Full Path Disclosure (FPD) vulnerability (CVSS 5.3, videogallery Vimeography)
- [CVE-2024-12478](https://cve.now/CVE-2024-12478.md): InvoicePlane 1 upload\_file unrestricted upload (CVSS 5.3, InvoicePlane)
- [CVE-2024-12362](https://cve.now/CVE-2024-12362.md): InvoicePlane invoices.php download path traversal (CVSS 5.3, InvoicePlane)
- [CVE-2024-54682](https://cve.now/CVE-2024-54682.md): Zipbomb DoS via Missing Slack Import Validation (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-54083](https://cve.now/CVE-2024-54083.md): DoS via lack of type validation in Calls (CVSS 6.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-48872](https://cve.now/CVE-2024-48872.md): Bypass of "Max failed attempts" restriction via race condition (CVSS 4.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-12646](https://cve.now/CVE-2024-12646.md): Chunghwa Telecom topm-client - Arbitrary File Delete (CVSS 8.1, Chunghwa Telecom topm-client)
- [CVE-2024-9679](https://cve.now/CVE-2024-9679.md): A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user cre (CVSS 5.3, Trellix DLP Extension)
- [CVE-2024-12645](https://cve.now/CVE-2024-12645.md): Chunghwa Telecom topm-client - Arbitrary File Read (CVSS 6.5, Chunghwa Telecom topm-client)
- [CVE-2024-12644](https://cve.now/CVE-2024-12644.md): Chunghwa Telecom tbm-client - Arbitrary File Copy and Paste (CVSS 7.1, Chunghwa Telecom tbm-client)
- [CVE-2024-12643](https://cve.now/CVE-2024-12643.md): Chunghwa Telecom tbm-client - Arbitrary File Delete (CVSS 8.1, Chunghwa Telecom tbm-client)
- [CVE-2024-9678](https://cve.now/CVE-2024-9678.md): An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. (CVSS 4.9, Trellix DLP Extension)
- [CVE-2024-12642](https://cve.now/CVE-2024-12642.md): Chunghwa Telecom TenderDocTransfer - Arbitrary File Write (CVSS 8.1, Chunghwa Telecom TenderDocTransfer)
- [CVE-2024-12641](https://cve.now/CVE-2024-12641.md): Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE (CVSS 9.6, Chunghwa Telecom TenderDocTransfer)
- [CVE-2024-5333](https://cve.now/CVE-2024-5333.md): The Events Calendar \< 6.8.2.1 - Unauthenticated Password Protected Event Disclosure (CVSS 5.3, The Events Calendar)
- [CVE-2024-11841](https://cve.now/CVE-2024-11841.md): Tithe.ly Giving Button \<= 1.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Tithe.ly Giving Button)
- [CVE-2024-8116](https://cve.now/CVE-2024-8116.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-8650](https://cve.now/CVE-2024-8650.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-29671](https://cve.now/CVE-2024-29671.md): Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request h (CVSS 9.8)
- [CVE-2024-37773](https://cve.now/CVE-2024-37773.md): An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code (CVSS 4.8)
- [CVE-2024-37774](https://cve.now/CVE-2024-37774.md): A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an (CVSS 8.0)
- [CVE-2024-37775](https://cve.now/CVE-2024-37775.md): Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC (CVSS 7.5)
- [CVE-2024-37776](https://cve.now/CVE-2024-37776.md): A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a cr (CVSS 4.8)
- [CVE-2024-52949](https://cve.now/CVE-2024-52949.md): iptraf-ng 1.2.1 has a stack-based buffer overflow. (CVSS 7.5)
- [CVE-2024-53376](https://cve.now/CVE-2024-53376.md): CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field t (CVSS 8.8)
- [CVE-2024-55085](https://cve.now/CVE-2024-55085.md): GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which ca (CVSS 9.8)
- [CVE-2024-55100](https://cve.now/CVE-2024-55100.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to (CVSS 4.8)
- [CVE-2024-55103](https://cve.now/CVE-2024-55103.md): Online Nurse Hiring System v1.0 was discovered to contain a SQL injection vulnerability in the component /admin/profile.php via the fullname (CVSS 7.2)
- [CVE-2024-55104](https://cve.now/CVE-2024-55104.md): Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via t (CVSS 7.2)
- [CVE-2024-55451](https://cve.now/CVE-2024-55451.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in UJCMS 9.6.3. (CVSS 4.8)
- [CVE-2024-55452](https://cve.now/CVE-2024-55452.md): A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel (CVSS 5.4)
- [CVE-2024-55554](https://cve.now/CVE-2024-55554.md): Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet. (CVSS 5.4)
- [CVE-2024-55557](https://cve.now/CVE-2024-55557.md): ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials. (CVSS 9.8)
- [CVE-2024-56083](https://cve.now/CVE-2024-56083.md): Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly\_generated\_string.de (CVSS 8.1)
- [CVE-2024-56084](https://cve.now/CVE-2024-56084.md): An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. (CVSS 7.1)
- [CVE-2024-56085](https://cve.now/CVE-2024-56085.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 5.9)
- [CVE-2024-56086](https://cve.now/CVE-2024-56086.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 7.1)
- [CVE-2024-56087](https://cve.now/CVE-2024-56087.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 5.9)
- [CVE-2024-56112](https://cve.now/CVE-2024-56112.md): CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.