# CVEs published 2025-01-02

239 CVEs were published on January 2, 2025: 2 critical, 42 high. Days are UTC.

- [CVE-2024-43769](https://cve.now/CVE-2024-43769.md): In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due (CVSS 7.8, Google Android)
- [CVE-2024-43768](https://cve.now/CVE-2024-43768.md): In skia\_alloc\_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2024-43767](https://cve.now/CVE-2024-43767.md): In prepare\_to\_draw\_into\_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. (CVSS 8.8, Google Android)
- [CVE-2024-43764](https://cve.now/CVE-2024-43764.md): In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. (CVSS 7.8, Google Android)
- [CVE-2024-43762](https://cve.now/CVE-2024-43762.md): In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-43097](https://cve.now/CVE-2024-43097.md): In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2024-43077](https://cve.now/CVE-2024-43077.md): In DevmemValidateFlags of devicemem\_server.c , there is a possible out of bounds write due to memory corruption. (CVSS 7.8, Google Android)
- [CVE-2024-8447](https://cve.now/CVE-2024-8447.md): Narayana: deadlock via multiple join requests sent to lra coordinator (CVSS 5.9, narayana · Red Hat JBoss EAP XP 5.0 Update +3)
- [CVE-2025-0173](https://cve.now/CVE-2025-0173.md): SourceCodester Online Eyewear Shop view\_order.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-56199](https://cve.now/CVE-2024-56199.md): phpMyFAQ Vulnerable to Stored HTML Injection at FAQ (CVSS 5.2, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2024-11717](https://cve.now/CVE-2024-11717.md): Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. (CVSS 6.3, CTFd)
- [CVE-2024-11716](https://cve.now/CVE-2024-11716.md): While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation al (CVSS 5.3, CTFd)
- [CVE-2024-12907](https://cve.now/CVE-2024-12907.md): XSS in Kentico 7 (CVSS 5.3, Kentico CMS)
- [CVE-2024-9950](https://cve.now/CVE-2024-9950.md): Abuse of Unauthenticated Compliance Recheck in SecureConnector (CVSS 8.5, Forescout SecureConnector)
- [CVE-2025-0172](https://cve.now/CVE-2025-0172.md): code-projects Chat System deleteroom.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2024-55541](https://cve.now/CVE-2024-55541.md): Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. (CVSS 3.1, Acronis Cyber Protect)
- [CVE-2024-55542](https://cve.now/CVE-2024-55542.md): Local privilege escalation due to excessive permissions assigned to Tray Monitor service. (CVSS 4.4, Acronis Cyber Protect)
- [CVE-2024-56414](https://cve.now/CVE-2024-56414.md): Web installer integrity check used weak hash algorithm. (CVSS 5.5, Acronis Cyber Protect)
- [CVE-2024-56413](https://cve.now/CVE-2024-56413.md): Missing session invalidation after user deletion. (CVSS 6.1, Acronis Cyber Protect)
- [CVE-2024-55540](https://cve.now/CVE-2024-55540.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.6, Acronis Cyber Protect)
- [CVE-2024-55543](https://cve.now/CVE-2024-55543.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis Cyber Protect)
- [CVE-2022-45811](https://cve.now/CVE-2022-45811.md): WordPress Post Teaser plugin \<= 4.1.5 - Auth. Broken Access Control vulnerability (CVSS 5.4, WeyHan Ng Post Teaser)
- [CVE-2022-47601](https://cve.now/CVE-2022-47601.md): WordPress WP Table Manager plugin \<= 3.5.2 - Broken Access Control (CVSS 5.3, JoomUnited WP Table Manager)
- [CVE-2023-23672](https://cve.now/CVE-2023-23672.md): WordPress GiveWP plugin \<= 2.25.1 - Arbitrary Content Deletion vulnerability (CVSS 5.4, Liquid Web / StellarWP GiveWP)
- [CVE-2023-32240](https://cve.now/CVE-2023-32240.md): WordPress Woodmart theme \<= 7.2.1 - Broken Access Control vulnerability (CVSS 5.4, Xtemos WoodMart)
- [CVE-2023-39994](https://cve.now/CVE-2023-39994.md): WordPress ARMember Premium plugin \<= 5.9.2 - Broken Access Control (CVSS 4.3, Repute InfoSystems ARMember Premium)
- [CVE-2022-45830](https://cve.now/CVE-2022-45830.md): WordPress Analytify - Google Analytics Dashboard plugin \<= 4.2.3 - Privilege Escalation vulnerability (CVSS 6.5, Analytify)
- [CVE-2025-0171](https://cve.now/CVE-2025-0171.md): code-projects Chat System deleteuser.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2023-40327](https://cve.now/CVE-2023-40327.md): WordPress Putler Connector for WooCommerce plugin \<= 2.12.0 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5, Putler / Storeapps Putler Connector for WooCommerce)
- [CVE-2023-45272](https://cve.now/CVE-2023-45272.md): WordPress 10Web Map Builder for Google Maps plugin \<= 1.0.73 - Notice Dismissal Vulnerability (CVSS 5.4, 10Web Map Builder for Google Maps)
- [CVE-2023-45633](https://cve.now/CVE-2023-45633.md): WordPress IMPress Listings plugin \<= 2.6.2 - Broken Access Control vulnerability (CVSS 6.5, IDX IMPress Listings)
- [CVE-2022-41995](https://cve.now/CVE-2022-41995.md): WordPress Photo Gallery – Image Gallery by Ape Plugin \<= 2.2.8 is vulnerable to Broken Access Control (CVSS 4.3, Galleryape Gallery Images Ape)
- [CVE-2022-49035](https://cve.now/CVE-2022-49035.md): media: s5p\_cec: limit msg.len to CEC\_MAX\_MSG\_SIZE (CVSS 5.5, Linux)
- [CVE-2024-56137](https://cve.now/CVE-2024-56137.md): MaxKB RCE vulnerability in function library (CVSS 6.8, 1Panel-dev MaxKB)
- [CVE-2022-43476](https://cve.now/CVE-2022-43476.md): WordPress Subscribe to Category Plugin \<= 2.7.4 is vulnerable to Broken Access Control (CVSS 4.3, Daniel Söderström / Sidney van de Stouwe Subscribe to Categ…)
- [CVE-2023-47778](https://cve.now/CVE-2023-47778.md): WordPress LuckyWP Scripts Control plugin \<= 1.2.1 - Broken Access Control vulnerability (CVSS 4.3, LuckyWP Scripts Control)
- [CVE-2023-47807](https://cve.now/CVE-2023-47807.md): WordPress 10WebAnalytics plugin \<= 1.2.12 - Broken Access Control vulnerability (CVSS 4.3, 10WebAnalytics)
- [CVE-2023-48739](https://cve.now/CVE-2023-48739.md): WordPress Porto Theme Functionality plugin \< 2.12.1 - Broken Access Control vulnerability (CVSS 5.3, Porto Theme - Functionality)
- [CVE-2024-49385](https://cve.now/CVE-2024-49385.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 5.5, Acronis True Image)
- [CVE-2024-55538](https://cve.now/CVE-2024-55538.md): Sensitive information disclosure due to missing authentication. (CVSS 4.0, Acronis True Image)
- [CVE-2023-48758](https://cve.now/CVE-2023-48758.md): WordPress JetEngine plugin \<= 3.2.4 - Broken Access Control vulnerability (CVSS 7.1, Crocoblock JetEngine)
- [CVE-2024-13111](https://cve.now/CVE-2024-13111.md): Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication (CVSS 6.3, Beijing Yunfan Internet Technology Yunfan Learning Examinat…)
- [CVE-2024-37237](https://cve.now/CVE-2024-37237.md): WordPress FS Poster plugin \<= 6.5.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, fs-code FS Poster)
- [CVE-2024-37241](https://cve.now/CVE-2024-37241.md): WordPress WP Job Manager Resume Manager plugin \<= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Automattic WP Job Manager - Resume Manager)
- [CVE-2024-37438](https://cve.now/CVE-2024-37438.md): WordPress Uncanny Toolkit Pro for LearnDash plugin \< 4.1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Uncanny Owl Uncanny Toolkit Pro for LearnDash)
- [CVE-2024-13110](https://cve.now/CVE-2024-13110.md): Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure (CVSS 5.3, Beijing Yunfan Internet Technology Yunfan Learning Examinat…)
- [CVE-2024-37452](https://cve.now/CVE-2024-37452.md): WordPress Schema Lite theme \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, MyThemeShop Schema Lite)
- [CVE-2024-37925](https://cve.now/CVE-2024-37925.md): WordPress BuddyBoss Theme theme \<= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, BuddyBoss Theme)
- [CVE-2024-37931](https://cve.now/CVE-2024-37931.md): WordPress Point theme \<= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Creativthemes Point)
- [CVE-2024-38731](https://cve.now/CVE-2024-38731.md): WordPress i-amaze theme \<= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Marsian i-amaze)
- [CVE-2024-38732](https://cve.now/CVE-2024-38732.md): WordPress Patricia Blog theme \<= 1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, VolThemes Patricia Blog)
- [CVE-2024-38764](https://cve.now/CVE-2024-38764.md): WordPress i-transform theme \<= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Marsian i-transform)
- [CVE-2024-13109](https://cve.now/CVE-2024-13109.md): Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization (CVSS 6.9, Beijing Yunfan Internet Technology Yunfan Learning Examinat…)
- [CVE-2024-38778](https://cve.now/CVE-2024-38778.md): WordPress WP Fast Total Search \<= 1.69.234 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Epsiloncool WP Fast Total Search)
- [CVE-2024-39623](https://cve.now/CVE-2024-39623.md): WordPress ListingPro theme \<= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (CVSS 8.8, CridioStudio ListingPro)
- [CVE-2024-13108](https://cve.now/CVE-2024-13108.md): D-Link DIR-816 A2 form2NetSniper.cgi access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-56014](https://cve.now/CVE-2024-56014.md): WordPress Olivia Theme \<= 0.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Markyis Cool Olivia)
- [CVE-2024-56257](https://cve.now/CVE-2024-56257.md): WordPress Coins MarketCap plugin \<= 5.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CoolPlugins Coins MarketCap)
- [CVE-2024-56268](https://cve.now/CVE-2024-56268.md): WordPress Post Grid Elementor Addon plugin \<= 2.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hookandhook Post Grid Elementor Addon)
- [CVE-2024-56302](https://cve.now/CVE-2024-56302.md): WordPress ConvertCalculator for WordPress plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jorisderuiter ConvertCalculator for WordPress)
- [CVE-2024-56267](https://cve.now/CVE-2024-56267.md): WordPress Interactive UK Map plugin \<= 3.4.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, html5maps Interactive UK Map)
- [CVE-2024-56266](https://cve.now/CVE-2024-56266.md): WordPress MP3 Audio Player plugin \<= 5.8 - Broken Access Control vulnerability (CVSS 6.3, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2024-56264](https://cve.now/CVE-2024-56264.md): WordPress ACF City Selector plugin \<= 1.14.0 - Arbitrary File Upload vulnerability (CVSS 6.6, Beee ACF City Selector)
- [CVE-2024-56263](https://cve.now/CVE-2024-56263.md): WordPress GS Shots for Dribbble plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GS Plugins GS Shots for Dribbble)
- [CVE-2024-56262](https://cve.now/CVE-2024-56262.md): WordPress GS Coaches plugin \<= 1.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GS Plugins GS Coaches)
- [CVE-2024-56261](https://cve.now/CVE-2024-56261.md): WordPress Project Showcase plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GS Plugins Project Showcase)
- [CVE-2024-56260](https://cve.now/CVE-2024-56260.md): WordPress ShopElement plugin \<= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, StorePlugin ShopElement)
- [CVE-2024-56259](https://cve.now/CVE-2024-56259.md): WordPress GeoDirectory plugin \<= 2.3.84 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Paolo GeoDirectory)
- [CVE-2024-56258](https://cve.now/CVE-2024-56258.md): WordPress Magazine Blocks plugin \<= 1.3.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BlockArt Magazine Blocks)
- [CVE-2024-56255](https://cve.now/CVE-2024-56255.md): WordPress AyeCode Connect plugin \<= 1.3.8 - Broken Access Control vulnerability (CVSS 4.3, Stiofan AyeCode Connect)
- [CVE-2024-56254](https://cve.now/CVE-2024-56254.md): WordPress Move Addons for Elementor plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, moveaddons Move Addons for Elementor)
- [CVE-2024-56253](https://cve.now/CVE-2024-56253.md): WordPress Data Tables Generator by Supsystic plugin \<= 1.10.36 - Broken Access Control vulnerability (CVSS 5.4, Data Tables Generator by Supsystic)
- [CVE-2024-56252](https://cve.now/CVE-2024-56252.md): WordPress Enter Addons plugin \<= 2.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themelooks Enter Addons)
- [CVE-2024-56251](https://cve.now/CVE-2024-56251.md): WordPress Event Espresso plugin \<= 5.0.28.decaf - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Event Espresso 4 Decaf)
- [CVE-2024-56250](https://cve.now/CVE-2024-56250.md): WordPress Just Writing Statistics plugin \<= 4.7 - SQL Injection vulnerability (CVSS 7.6, Greg Ross Just Writing Statistics)
- [CVE-2024-56249](https://cve.now/CVE-2024-56249.md): WordPress WPMasterToolKit plugin \<= 1.13.1 - Arbitrary File Upload vulnerability (CVSS 9.1, Ludwig You WPMasterToolKit)
- [CVE-2024-56248](https://cve.now/CVE-2024-56248.md): WordPress WPMasterToolKit plugin \<= 1.13.1 - Arbitrary File Download vulnerability (CVSS 4.9, Ludwig You WPMasterToolKit)
- [CVE-2024-56247](https://cve.now/CVE-2024-56247.md): WordPress WP Post Author plugin \<= 3.8.2 - SQL Injection vulnerability (CVSS 7.6, AF themes WP Post Author)
- [CVE-2024-56246](https://cve.now/CVE-2024-56246.md): WordPress Nexter Blocks plugin \<= 4.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH Nexter Blocks)
- [CVE-2024-56245](https://cve.now/CVE-2024-56245.md): WordPress Premium Blocks plugin \<= 2.1.42 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2024-56244](https://cve.now/CVE-2024-56244.md): WordPress Ashe Extra plugin \<= 1.2.92 - Broken Access Control vulnerability (CVSS 5.4, WP Royal Ashe Extra)
- [CVE-2024-56243](https://cve.now/CVE-2024-56243.md): WordPress WPSSO Core plugin \<= 18.18.1 - Broken Access Control vulnerability (CVSS 4.3, JS Morisset WPSSO Core)
- [CVE-2024-56242](https://cve.now/CVE-2024-56242.md): WordPress Arconix Shortcodes plugin \<= 2.1.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tychesoftwares Arconix Shortcodes)
- [CVE-2024-56241](https://cve.now/CVE-2024-56241.md): WordPress WPKoi Templates for Elementor plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2024-56240](https://cve.now/CVE-2024-56240.md): WordPress Pronamic Google Maps plugin \<= 2.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pronamic Google Maps)
- [CVE-2024-56239](https://cve.now/CVE-2024-56239.md): WordPress Themify Audio Dock plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themifyme Themify Audio Dock)
- [CVE-2024-56238](https://cve.now/CVE-2024-56238.md): WordPress Floating Action Buttons plugin \<= 0.9.1 - Broken Access Control vulnerability (CVSS 5.3, QuantumCloud Floating Action Buttons)
- [CVE-2024-56237](https://cve.now/CVE-2024-56237.md): WordPress Contest Gallery plugin \<= 24.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-56236](https://cve.now/CVE-2024-56236.md): WordPress Hestia Nginx Cache plugin \<= 2.4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Juni Hestia Nginx Cache)
- [CVE-2024-56026](https://cve.now/CVE-2024-56026.md): WordPress Simple Proxy plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Greg – SiteOrigin Simple Proxy)
- [CVE-2024-56025](https://cve.now/CVE-2024-56025.md): WordPress AdWork Media EZ Content Locker plugin \<= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, adworkmedia AdWork Media EZ Content Locker)
- [CVE-2024-56024](https://cve.now/CVE-2024-56024.md): WordPress Custom Dashboard Widget plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DuoGeek Custom Dashboard Widget)
- [CVE-2024-56023](https://cve.now/CVE-2024-56023.md): WordPress WP eCommerce Quickpay plugin \<= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PerfectSolution WP eCommerce Quickpay)
- [CVE-2024-56022](https://cve.now/CVE-2024-56022.md): WordPress Preloader by WordPress Monsters plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Preloader by WordPress Monsters)
- [CVE-2024-56018](https://cve.now/CVE-2024-56018.md): WordPress BU Section Editing Plugin \<= 0.9.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BU Web Team BU Section Editing)
- [CVE-2024-43927](https://cve.now/CVE-2024-43927.md): WordPress Email Address Encoder plugin \<= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Till Krüss Email Address Encoder)
- [CVE-2024-38790](https://cve.now/CVE-2024-38790.md): WordPress Smartsupp plugin \<= 3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Smartsupp – live chat, chatbots, AI and lead generation)
- [CVE-2024-38789](https://cve.now/CVE-2024-38789.md): WordPress Telegram Bot & Channel plugin \<= 3.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.3, Marco Milesi Telegram Bot & Channel)
- [CVE-2024-38766](https://cve.now/CVE-2024-38766.md): WordPress Matomo Analytics plugin \<= 5.1.1 - Cross Site Request Forgery (CSRF) leading to Notice Dismissal vulnerability (CVSS 4.3, matomoteam Matomo Analytics)
- [CVE-2024-38765](https://cve.now/CVE-2024-38765.md): WordPress Oceanic theme \<= 1.0.48 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, outtheboxthemes Oceanic)
- [CVE-2024-38763](https://cve.now/CVE-2024-38763.md): WordPress Popularis Verse theme \<= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, themes4wp Popularis Verse)
- [CVE-2024-38762](https://cve.now/CVE-2024-38762.md): WordPress Event Tickets and Registration plugin \<= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StellarWP Event Tickets)
- [CVE-2024-38754](https://cve.now/CVE-2024-38754.md): WordPress Tagbox plugin \<= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Taggbox)
- [CVE-2024-38753](https://cve.now/CVE-2024-38753.md): WordPress Animated Rotating Words Plugin \<= 5.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Labib Ahmed Animated Rotating Words)
- [CVE-2024-38751](https://cve.now/CVE-2024-38751.md): WordPress AdsforWP plugin \<= 1.9.28 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Magazine3 Google Adsense & Banner Ads by AdsforWP)
- [CVE-2024-38729](https://cve.now/CVE-2024-38729.md): WordPress MBE eShip plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, mbeelink MBE eShip)
- [CVE-2024-38691](https://cve.now/CVE-2024-38691.md): WordPress Metorik plugin \<= 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Metorik – Reports & Email Automation for WooCommerce)
- [CVE-2024-37937](https://cve.now/CVE-2024-37937.md): WordPress Rara Business theme \<= 1.2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Rara Business)
- [CVE-2024-37543](https://cve.now/CVE-2024-37543.md): WordPress Ultimate Auction plugin \<= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Nitesh Ultimate Auction)
- [CVE-2024-37540](https://cve.now/CVE-2024-37540.md): WordPress Leaky Paywall plugin \<= 4.21.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ZEEN101 Leaky Paywall)
- [CVE-2024-37518](https://cve.now/CVE-2024-37518.md): WordPress The Events Calendar plugin \<= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StellarWP The Events Calendar)
- [CVE-2024-37511](https://cve.now/CVE-2024-37511.md): WordPress Swift Performance Lite plugin \<= 2.3.6.20 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, swte Swift Performance Lite)
- [CVE-2024-37508](https://cve.now/CVE-2024-37508.md): WordPress Construction Landing Page theme \<= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Construction Landing Page)
- [CVE-2024-37503](https://cve.now/CVE-2024-37503.md): WordPress Lawyer Landing Page theme \<= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Lawyer Landing Page)
- [CVE-2024-37493](https://cve.now/CVE-2024-37493.md): WordPress Posterity theme \<= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, sonalsinha21 Posterity)
- [CVE-2024-37491](https://cve.now/CVE-2024-37491.md): WordPress Rife Free theme \<= 2.4.18 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, apollo13themes Rife Free)
- [CVE-2024-37490](https://cve.now/CVE-2024-37490.md): WordPress Bard theme \<= 2.210 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wproyal Bard)
- [CVE-2024-37478](https://cve.now/CVE-2024-37478.md): WordPress Ashe theme \<= 2.233 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wproyal Ashe)
- [CVE-2024-37473](https://cve.now/CVE-2024-37473.md): WordPress Trendy News theme \<= 1.0.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, blazethemes Trendy News)
- [CVE-2024-37469](https://cve.now/CVE-2024-37469.md): WordPress Blocksy theme \<= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, creativethemeshq Blocksy)
- [CVE-2024-37467](https://cve.now/CVE-2024-37467.md): WordPress Hestia theme \<= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, themeisle Hestia)
- [CVE-2024-37458](https://cve.now/CVE-2024-37458.md): WordPress Highlight theme \<= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, extendthemes Highlight)
- [CVE-2024-37451](https://cve.now/CVE-2024-37451.md): WordPress Travel Agency theme \<= 1.4.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Travel Agency)
- [CVE-2024-37450](https://cve.now/CVE-2024-37450.md): WordPress Benevolent theme \<= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Benevolent)
- [CVE-2024-37448](https://cve.now/CVE-2024-37448.md): WordPress OnePress theme \<= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, famethemes OnePress)
- [CVE-2024-37441](https://cve.now/CVE-2024-37441.md): WordPress NewsMash theme \<= 1.0.34 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, desertthemes NewsMash)
- [CVE-2024-37435](https://cve.now/CVE-2024-37435.md): WordPress Perfect Portfolio theme \<= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Perfect Portfolio)
- [CVE-2024-37431](https://cve.now/CVE-2024-37431.md): WordPress Mesmerize theme \<= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, extendthemes Mesmerize)
- [CVE-2024-37426](https://cve.now/CVE-2024-37426.md): WordPress Elegant Pink theme 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Elegant Pink)
- [CVE-2024-37421](https://cve.now/CVE-2024-37421.md): WordPress JobScout theme \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme JobScout)
- [CVE-2024-37417](https://cve.now/CVE-2024-37417.md): WordPress Coachify theme \<= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpcoachify Coachify)
- [CVE-2024-37413](https://cve.now/CVE-2024-37413.md): WordPress Preschool and Kindergarten theme \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Preschool and Kindergarten)
- [CVE-2024-37412](https://cve.now/CVE-2024-37412.md): WordPress Blossom Shop theme \<= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, blossomthemes Blossom Shop)
- [CVE-2024-37274](https://cve.now/CVE-2024-37274.md): WordPress WP Mobile Menu plugin \<= 2.8.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rui Guerreiro WP Mobile Menu)
- [CVE-2024-37272](https://cve.now/CVE-2024-37272.md): WordPress Travel Monster theme \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wptravelengine Travel Monster)
- [CVE-2024-37243](https://cve.now/CVE-2024-37243.md): WordPress Vandana Lite theme \<= 1.1.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, blossomthemes Vandana Lite)
- [CVE-2024-37242](https://cve.now/CVE-2024-37242.md): WordPress Newspack Newsletters plugin \<= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Automattic Newspack Newsletters)
- [CVE-2024-37240](https://cve.now/CVE-2024-37240.md): WordPress Falang multilanguage for WordPress plugin \<= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, sbouey Falang multilanguage)
- [CVE-2024-37238](https://cve.now/CVE-2024-37238.md): WordPress WPAdverts plugin \<= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Greg Winiarski WPAdverts)
- [CVE-2024-37236](https://cve.now/CVE-2024-37236.md): WordPress Loco Translate plugin \<= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Tim W Loco Translate)
- [CVE-2024-37235](https://cve.now/CVE-2024-37235.md): WordPress Groundhogg plugin \<= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Adrian Tobey Groundhogg)
- [CVE-2024-37104](https://cve.now/CVE-2024-37104.md): WordPress Chic Lite theme \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Chic Lite)
- [CVE-2024-37103](https://cve.now/CVE-2024-37103.md): WordPress Education Zone theme \<= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, raratheme Education Zone)
- [CVE-2024-37102](https://cve.now/CVE-2024-37102.md): WordPress Vilva theme \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, blossomthemes Vilva)
- [CVE-2024-37093](https://cve.now/CVE-2024-37093.md): WordPress MasterStudy LMS plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Stylemix MasterStudy LMS)
- [CVE-2023-47693](https://cve.now/CVE-2023-47693.md): WordPress Ultimate Addons for Contact Form 7 plugin \<= 3.2.6 - Broken Access Control vulnerability (CVSS 7.5, Themefic Ultimate Addons for Contact Form)
- [CVE-2023-47692](https://cve.now/CVE-2023-47692.md): WordPress Flo Forms plugin \<= 1.0.41 - Broken Access Control vulnerability (CVSS 4.3, flothemesplugins Flo Forms)
- [CVE-2023-47689](https://cve.now/CVE-2023-47689.md): WordPress Animator plugin \<= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability (CVSS 6.5, Toast Plugins Animator)
- [CVE-2023-47661](https://cve.now/CVE-2023-47661.md): WordPress Dragfy Addons for Elementor plugin \<= 1.0.2 - Broken Access Control + CSRF vulnerability (CVSS 5.4, Dragfy Addons for Elementor)
- [CVE-2023-47648](https://cve.now/CVE-2023-47648.md): WordPress EazyDocs plugin \<= 2.3.5 - Broken Access Control vulnerability (CVSS 7.5, Spider Themes EazyDocs)
- [CVE-2023-47647](https://cve.now/CVE-2023-47647.md): WordPress BadgeOS plugin \<= 3.7.1.6 - Broken Access Control vulnerability (CVSS 4.3, LearningTimes BadgeOS)
- [CVE-2023-47557](https://cve.now/CVE-2023-47557.md): WordPress Visitor Traffic Real Time Statistics plugin \<= 7.2 - Broken Access Control vulnerability (CVSS 4.3, wp-buy Visitors Traffic Real Time Statistics)
- [CVE-2023-47523](https://cve.now/CVE-2023-47523.md): WordPress Auto Tag Creator plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 4.3, Ecreate Infotech Auto Tag Creator)
- [CVE-2023-47515](https://cve.now/CVE-2023-47515.md): WordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin \<= 8.1.1 - Broken Access Control vulnerability (CVSS 5.3, Seers)
- [CVE-2023-47241](https://cve.now/CVE-2023-47241.md): WordPress CoCart – Headless ecommerce plugin \<= 3.11.2 - Broken Access Control vulnerability (CVSS 5.3, CoCart Headless CoCart – Headless ecommerce)
- [CVE-2023-47225](https://cve.now/CVE-2023-47225.md): WordPress Short URL plugin \<= 1.6.8 - Broken Access Control vulnerability (CVSS 5.4, KaizenCoders Short URL)
- [CVE-2023-47224](https://cve.now/CVE-2023-47224.md): WordPress WP Travel plugin \<= 7.8.0 - Broken Access Control vulnerability (CVSS 7.5, WP Travel)
- [CVE-2023-47188](https://cve.now/CVE-2023-47188.md): WordPress Simple Job Board plugin \<= 2.10.5 - Broken Access Control vulnerability (CVSS 5.3, PressTigers Simple Job Board)
- [CVE-2023-47187](https://cve.now/CVE-2023-47187.md): WordPress Animated Rotating Words plugin \<= 5.4 - Broken Access Control vulnerability (CVSS 5.4, Labib Ahmed Animated Rotating Words)
- [CVE-2023-47183](https://cve.now/CVE-2023-47183.md): WordPress GiveWP plugin \<= 2.33.1 - Broken Access Control vulnerability (CVSS 5.3, StellarWP GiveWP)
- [CVE-2023-47180](https://cve.now/CVE-2023-47180.md): WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin \<= 2.16.0 - Arbitrary Content Deletion vulnerability (CVSS 6.5, XLPlugins Finale Lite)
- [CVE-2023-47179](https://cve.now/CVE-2023-47179.md): WordPress WooODT Lite plugin \<= 2.4.6 - Arbitrary Site Option Update vulnerability (CVSS 8.8, mdalabar WooODT Lite)
- [CVE-2023-46644](https://cve.now/CVE-2023-46644.md): WordPress WordPress CTA plugin \<= 1.5.8 - Broken Access Control vulnerability (CVSS 6.5, WP CTA PRO WordPress CTA)
- [CVE-2023-46639](https://cve.now/CVE-2023-46639.md): WordPress kk Star Ratings plugin \<= 5.4.5 - Broken Access Control vulnerability (CVSS 5.3, FeedbackWP kk Star Ratings)
- [CVE-2023-46637](https://cve.now/CVE-2023-46637.md): WordPress Generate Dummy Posts plugin \<= 1.0.0 - Broken Access Control vulnerability (CVSS 5.3, Saurav Sharma Generate Dummy Posts)
- [CVE-2023-46635](https://cve.now/CVE-2023-46635.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.2.0 - Broken Access Control vulnerability (CVSS 5.3, YITHEMES YITH WooCommerce Product Add-Ons)
- [CVE-2023-46633](https://cve.now/CVE-2023-46633.md): WordPress WP Glossary plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 5.4, TCBarrett Glossary)
- [CVE-2023-46632](https://cve.now/CVE-2023-46632.md): WordPress My Shortcodes plugin \<= 2.3 - Broken Access Control vulnerability (CVSS 7.1, David Cramer My Shortcodes)
- [CVE-2023-46631](https://cve.now/CVE-2023-46631.md): WordPress Product Recommendation Quiz for eCommerce plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 6.5, RevenueHunt Product Recommendation Quiz for eCommerce)
- [CVE-2023-46628](https://cve.now/CVE-2023-46628.md): WordPress WP Word Count plugin \<= 3.2.4 - Broken Access Control vulnerability (CVSS 4.3, RedLettuce Plugins WP Word Count)
- [CVE-2023-46616](https://cve.now/CVE-2023-46616.md): WordPress Draw Attention plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 5.4, NSquared Draw Attention)
- [CVE-2023-46612](https://cve.now/CVE-2023-46612.md): WordPress Mediabay plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 4.3, codedraft Mediabay)
- [CVE-2023-46611](https://cve.now/CVE-2023-46611.md): WordPress YOP Poll plugin \<= 6.5.28 - Vote Manipulation Due to Broken Captcha Control Vulnerability (CVSS 5.3, yourownprogrammer YOP Poll)
- [CVE-2023-46610](https://cve.now/CVE-2023-46610.md): WordPress Quill Forms plugin \<= 3.3.0 - Broken Access Control + CSRF vulnerability (CVSS 6.5, Mohamed Magdy Quill Forms)
- [CVE-2023-46609](https://cve.now/CVE-2023-46609.md): WordPress FeedFocal plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 6.5, FeedFocal)
- [CVE-2023-46608](https://cve.now/CVE-2023-46608.md): WordPress DoLogin Security plugin \<= 3.7.1 - Multiple Broken Access Control vulnerability (CVSS 5.3, WPDO DoLogin Security)
- [CVE-2023-46607](https://cve.now/CVE-2023-46607.md): WordPress WP iCal Availability plugin \<= 1.0.3 - Broken Access Control vulnerability (CVSS 5.4, WP iCal Availability)
- [CVE-2023-46606](https://cve.now/CVE-2023-46606.md): WordPress AtomChat plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 5.3, Team AtomChat AtomChat)
- [CVE-2023-46605](https://cve.now/CVE-2023-46605.md): WordPress Convertful – Your Ultimate On-Site Conversion Tool plugin \<= 2.5 - Broken Access Control vulnerability (CVSS 5.3, Ruslan Suhar Convertful – Your Ultimate On-Site Conversion…)
- [CVE-2023-46309](https://cve.now/CVE-2023-46309.md): WordPress wpDiscuz plugin \<= 7.6.10 - Broken Access Control vulnerability (CVSS 5.3, AdvancedCoding wpDiscuz)
- [CVE-2024-13107](https://cve.now/CVE-2024-13107.md): D-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2023-46206](https://cve.now/CVE-2023-46206.md): WordPress MW WP Form plugin \<= 4.4.5 - Broken Access Control vulnerability (CVSS 5.3, Webの相談所 MW WP Form)
- [CVE-2023-46203](https://cve.now/CVE-2023-46203.md): WordPress Just Custom Fields plugin \<= 3.3.2 - Broken Access Control vulnerability (CVSS 4.3, JustCoded / Alex Prokopenko Just Custom Fields)
- [CVE-2023-46196](https://cve.now/CVE-2023-46196.md): WordPress Social proof testimonials and reviews by Repuso plugin \<= 4.97 - Broken Access Control vulnerability (CVSS 4.3, Social proof testimonials and reviews by Repuso)
- [CVE-2023-46195](https://cve.now/CVE-2023-46195.md): WordPress Headline Analyzer plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 6.5, CoSchedule Headline Analyzer)
- [CVE-2023-46188](https://cve.now/CVE-2023-46188.md): WordPress Freesoul Deactivate Plugins plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 4.3, Jose Mortellaro Freesoul Deactivate Plugins – Plugin manage…)
- [CVE-2023-46083](https://cve.now/CVE-2023-46083.md): WordPress Kali Forms plugin \<= 2.3.27 - Broken Access Control vulnerability (CVSS 5.3, WP Chill Kali Forms)
- [CVE-2023-46082](https://cve.now/CVE-2023-46082.md): WordPress Broken Link Checker | Finder plugin \<= 2.4.2 - Broken Access Control vulnerability (CVSS 5.3, Cyberlord92 Broken Link Checker | Finder)
- [CVE-2023-46080](https://cve.now/CVE-2023-46080.md): WordPress ApplyOnline – Application Form Builder and Manager plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 4.3, Farhan Noor ApplyOnline – Application Form Builder and Mana…)
- [CVE-2023-46079](https://cve.now/CVE-2023-46079.md): WordPress Ashe Extra plugin \<= 1.2.9 - Broken Access Control + CSRF vulnerability (CVSS 5.4, WP Royal Ashe Extra)
- [CVE-2023-46073](https://cve.now/CVE-2023-46073.md): WordPress DX Delete Attached Media plugin \<= 2.0.5.1 - Broken Access Control vulnerability + CSRF (CVSS 5.3, Mario Peshev DX Delete Attached Media)
- [CVE-2023-45828](https://cve.now/CVE-2023-45828.md): WordPress RumbleTalk Live Group Chat plugin \<= 6.2.5 - Broken Access Control vulnerability (CVSS 5.4, RumbleTalk Live Group Chat)
- [CVE-2023-45766](https://cve.now/CVE-2023-45766.md): WordPress Poll Maker plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 5.3, Ays Pro Poll Maker)
- [CVE-2023-45765](https://cve.now/CVE-2023-45765.md): WordPress WP ERP plugin \<= 1.12.6 - Broken Access Control vulnerability (CVSS 4.3, weDevs WP ERP)
- [CVE-2023-45760](https://cve.now/CVE-2023-45760.md): WordPress wpDiscuz plugin \<= 7.6.3 - Broken Access Control vulnerability (CVSS 4.3, AdvancedCoding wpDiscuz)
- [CVE-2023-45649](https://cve.now/CVE-2023-45649.md): WordPress Appointment Hour Booking plugin \<= 1.4.23 - Broken Access Control vulnerability (CVSS 5.3, codepeople Appointment Hour Booking)
- [CVE-2023-45636](https://cve.now/CVE-2023-45636.md): WordPress Backup & Migration plugin \<= 1.4.1 - Broken Access Control vulnerability (CVSS 5.4, WebToffee WordPress Backup & Migration)
- [CVE-2023-45631](https://cve.now/CVE-2023-45631.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 4.3, wpdevart Responsive Image Gallery, Gallery Album)
- [CVE-2023-45275](https://cve.now/CVE-2023-45275.md): WordPress Contact Form builder with drag & drop plugin \<= 2.3.28 - Broken Access Control vulnerability (CVSS 6.5, WP Chill Kali Forms)
- [CVE-2023-45271](https://cve.now/CVE-2023-45271.md): WordPress ProductX – Gutenberg WooCommerce Blocks plugin \<= 2.7.8 - Broken Access Control vulnerability (CVSS 4.3, WPXPO WowStore)
- [CVE-2023-45110](https://cve.now/CVE-2023-45110.md): WordPress Bold Timeline Lite plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 4.3, boldthemes Bold Timeline Lite)
- [CVE-2023-45104](https://cve.now/CVE-2023-45104.md): WordPress BetterLinks plugin \<= 1.6.0 - Broken Access Control vulnerability (CVSS 7.3, WPDeveloper BetterLinks)
- [CVE-2023-45101](https://cve.now/CVE-2023-45101.md): WordPress Customer Reviews for WooCommerce plugin \<= 5.36.0 - Broken Access Control vulnerability (CVSS 4.3, CusRev Customer Reviews for WooCommerce)
- [CVE-2023-45061](https://cve.now/CVE-2023-45061.md): WordPress WP Job Openings plugin \<= 3.4.1 - Broken Access Control vulnerability (CVSS 5.3, awsm.in WP Job Openings)
- [CVE-2023-45045](https://cve.now/CVE-2023-45045.md): WordPress WP Custom Widget area plugin \<= 1.2.5 - Broken Access Control vulnerability (CVSS 5.4, krozero WP Custom Widget area)
- [CVE-2023-45002](https://cve.now/CVE-2023-45002.md): WordPress WP User Frontend plugin \<= 3.6.8 - Broken Access Control vulnerability (CVSS 4.3, weDevs WP User Frontend)
- [CVE-2023-44988](https://cve.now/CVE-2023-44988.md): WordPress WP Custom Admin Interface plugin \<= 7.32 - Broken Access Control vulnerability (CVSS 4.3, Martin Gibson WP Custom Admin Interface)
- [CVE-2023-44258](https://cve.now/CVE-2023-44258.md): WordPress Schema App Structured Data plugin \<= 1.23.1 - Broken Access Control + CSRF vulnerability (CVSS 5.3, vberkel Schema App Structured Data)
- [CVE-2024-13106](https://cve.now/CVE-2024-13106.md): D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-13105](https://cve.now/CVE-2024-13105.md): D-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-13104](https://cve.now/CVE-2024-13104.md): D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-13103](https://cve.now/CVE-2024-13103.md): D-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-13102](https://cve.now/CVE-2024-13102.md): D-Link DIR-816 A2 DDNS Service access control (CVSS 6.9, D-Link DIR-816 A2)
- [CVE-2024-56027](https://cve.now/CVE-2024-56027.md): WordPress Leads CRM plugin \<= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bizswoop Leads CRM)
- [CVE-2024-56028](https://cve.now/CVE-2024-56028.md): WordPress Lemonade Social Networks Autoposter Pinterest plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, lemonadestudio Lemonade Social Networks Autoposter Pinterest)
- [CVE-2024-56029](https://cve.now/CVE-2024-56029.md): WordPress Easy Language Switcher plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, dreamwinner Easy Language Switcher)
- [CVE-2024-56030](https://cve.now/CVE-2024-56030.md): WordPress 10CentMail plugin \<= 2.1.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Carver Lab 10CentMail)
- [CVE-2024-56032](https://cve.now/CVE-2024-56032.md): WordPress FV Descriptions plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FolioVision FV Descriptions)
- [CVE-2024-56033](https://cve.now/CVE-2024-56033.md): WordPress FAQs plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Think201 FAQs)
- [CVE-2024-56019](https://cve.now/CVE-2024-56019.md): WordPress Inline Footnotes Plugin \<= 2.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, gavinr Inline Footnotes)
- [CVE-2024-56034](https://cve.now/CVE-2024-56034.md): WordPress Services updates for customers plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Irshad A.Khan Services updates for customers)
- [CVE-2024-56035](https://cve.now/CVE-2024-56035.md): WordPress Upload Scanner plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kurt Payne Upload Scanner)
- [CVE-2024-56036](https://cve.now/CVE-2024-56036.md): WordPress odPhotogallery plugin \<= 0.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ondrej Donek odPhotogallery)
- [CVE-2024-56037](https://cve.now/CVE-2024-56037.md): WordPress User Referral plugin \<= 8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, SoftClever Limited User Referral)
- [CVE-2024-56038](https://cve.now/CVE-2024-56038.md): WordPress SendSMS Plugin \<= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, catalinsendsms SendSMS)
- [CVE-2024-56060](https://cve.now/CVE-2024-56060.md): WordPress HTML Forms plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Link Software HTML Forms)
- [CVE-2024-56069](https://cve.now/CVE-2024-56069.md): WordPress WP SuperBackup plugin \<= 2.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, azzaroco WP SuperBackup)
- [CVE-2024-13062](https://cve.now/CVE-2024-13062.md): An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution. (CVSS 7.2, ASUS Router)
- [CVE-2024-12912](https://cve.now/CVE-2024-12912.md): An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. (CVSS 7.2, ASUS Router)
- [CVE-2024-13093](https://cve.now/CVE-2024-13093.md): code-projects Job Recruitment Seeker Profile \_call\_main\_search\_ajax.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2024-13092](https://cve.now/CVE-2024-13092.md): code-projects Job Recruitment Job Post search\_ajax.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2024-12595](https://cve.now/CVE-2024-12595.md): AHAthat Plugin \<= 1.6 - Reflected XSS via REQUEST\_URI (CVSS 4.7, AHAthat Plugin)
- [CVE-2024-11357](https://cve.now/CVE-2024-11357.md): Goodlayers Core \< 2.0.10 - Contributor+ Stored XSS (CVSS 5.9, goodlayers-core)
- [CVE-2024-11184](https://cve.now/CVE-2024-11184.md): WP Enabled SVG \<= 0.7 - Author+ Stored XSS via SVG (CVSS 4.8, wp-enable-svg · mwdelaney/wp-enable-svg)
- [CVE-2002-20002](https://cve.now/CVE-2002-20002.md): The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptogr (CVSS 5.4)
- [CVE-2024-48197](https://cve.now/CVE-2024-48197.md): Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the w (CVSS 4.7)
- [CVE-2024-56829](https://cve.now/CVE-2024-56829.md): Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the (CVSS 10.0)
- [CVE-2024-56830](https://cve.now/CVE-2024-56830.md): The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present. (CVSS 5.4)
- [CVE-2025-22214](https://cve.now/CVE-2025-22214.md): Landray EIS 2001 through 2006 allows Message/fi\_message\_receiver.aspx?replyid= SQL injection. (CVSS 4.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-01-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.