# CVEs published 2024-12-21

30 CVEs were published on December 21, 2024: 1 critical, 4 high. Days are UTC.

- [CVE-2024-12884](https://cve.now/CVE-2024-12884.md): Codezips E-Commerce Website login.php sql injection (CVSS 6.9, Codezips E-Commerce Website)
- [CVE-2024-51463](https://cve.now/CVE-2024-51463.md): IBM i server-side request forgery (CVSS 5.4, IBM i)
- [CVE-2024-51464](https://cve.now/CVE-2024-51464.md): IBM i authentication bypass (CVSS 4.3, IBM i)
- [CVE-2024-12883](https://cve.now/CVE-2024-12883.md): code-projects Job Recruitment \_email.php cross site scripting (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-12875](https://cve.now/CVE-2024-12875.md): Easy Digital Downloads \<= 3.3.2 - Authenticated (Admin+) Arbitrary File Download (CVSS 4.9, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-12591](https://cve.now/CVE-2024-12591.md): MagicPost \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb\_share\_social Shortcode (CVSS 6.4, wbolt MagicPost – WordPress文章管理功能增强插件)
- [CVE-2024-10453](https://cve.now/CVE-2024-10453.md): Elementor Website Builder – More than Just a Page Builder \<= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-11688](https://cve.now/CVE-2024-11688.md): LaTeX2HTML \<= 2.5.5 - Reflected Cross-Site Scripting (CVSS 6.1, van-abel LaTeX2HTML)
- [CVE-2024-11722](https://cve.now/CVE-2024-11722.md): Frontend Admin by DynamiApps \<= 3.25.1 - Unauthenticated SQL Injection (CVSS 5.9, shabti Frontend Admin by DynamiApps)
- [CVE-2024-12408](https://cve.now/CVE-2024-12408.md): WP on AWS \<= 5.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, wpseahorse WP on AWS)
- [CVE-2024-12558](https://cve.now/CVE-2024-12558.md): WP BASE Booking of Appointments, Services and Events \<= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app\_export\_db (CVSS 6.5, puckrobin WP BASE Booking of Appointments, Services and Eve…)
- [CVE-2024-10797](https://cve.now/CVE-2024-10797.md): Full Screen Menu for Elementor \<= 1.0.7 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, solitweb Full Screen Menu for Elementor)
- [CVE-2024-11808](https://cve.now/CVE-2024-11808.md): Pingmeter Uptime Monitoring \<= 1.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, Pingmeter Uptime Monitoring)
- [CVE-2024-12588](https://cve.now/CVE-2024-12588.md): Shortcodes and extra features for Phlox theme \<= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-9545](https://cve.now/CVE-2024-9545.md): Shortcodes and extra features for Phlox theme \<= 2.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via aux\_contact\_box and aux\_gmaps Shortcodes (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-11975](https://cve.now/CVE-2024-11975.md): Reactflow Visitor Recording and Heatmaps \<= 1.0.10 - Reflected Cross-Site Scripting (CVSS 6.1, Reactflow Visitor Recording and Heatmaps)
- [CVE-2024-11682](https://cve.now/CVE-2024-11682.md): G Web Pro Store Locator \<= 2.1 - Reflected Cross-Site Scripting (CVSS 6.1, moonheart G Web Pro Store Locator)
- [CVE-2024-11196](https://cve.now/CVE-2024-11196.md): Multi-column Tag Map \<= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode (CVSS 6.4, tugbucket Multi-column Tag Map)
- [CVE-2024-12697](https://cve.now/CVE-2024-12697.md): real.Kit \<= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, realmaster-1 real.Kit)
- [CVE-2024-12262](https://cve.now/CVE-2024-12262.md): Ebook Store \<= 5.8001 - Reflected Cross-Site Scripting via 'step' (CVSS 6.1, motovnet Ebook Store)
- [CVE-2024-12635](https://cve.now/CVE-2024-12635.md): WP Docs \<= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir\_id' (CVSS 6.5, fahadmahmood WP Docs)
- [CVE-2024-11938](https://cve.now/CVE-2024-11938.md): One Click Upsell Funnel for WooCommerce \<= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via wps\_wocuf\_pro\_yes Shortcode (CVSS 6.4, wpswings One Click Upsell Funnel for Woocommerce)
- [CVE-2024-12721](https://cve.now/CVE-2024-12721.md): Custom Product Tabs For WooCommerce \<= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection (CVSS 7.2, webbuilder143 Custom Product tabs for WooCommerce)
- [CVE-2024-12771](https://cve.now/CVE-2024-12771.md): eCommerce Product Catalog Plugin for WordPress \<= 3.3.43 - Cross-Site Request Forgery to Password Reset (CVSS 8.8, implecode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2024-12066](https://cve.now/CVE-2024-12066.md): SMSA Shipping(official) \<= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, smsaexpress SMSA Shipping)
- [CVE-2024-11287](https://cve.now/CVE-2024-11287.md): Ebook Store \<= 5.8001 - Reflected Cross-Site Scripting (CVSS 6.1, motovnet Ebook Store)
- [CVE-2024-11607](https://cve.now/CVE-2024-11607.md): GTPayment Donations \<= 1.0.0 - Stored XSS via CSRF (CVSS 6.1, GTPayment Donations)
- [CVE-2024-11977](https://cve.now/CVE-2024-11977.md): kk Star Ratings – Rate Post & Collect User Feedbacks \<= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, properfraction kk Star Ratings – Rate Post & Collect User F…)
- [CVE-2024-12846](https://cve.now/CVE-2024-12846.md): Emlog Pro link.php cross site scripting (CVSS 6.9, Emlog Pro)
- [CVE-2024-11349](https://cve.now/CVE-2024-11349.md): AdForest \<= 5.1.6 - Authentication Bypass (CVSS 9.8, scriptsbundle AdForest)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.