CVE-2024-3275

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-327529.1The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow CVE-2024-327537.0Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-CVE-2024-327543.1Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, seri CVE-2024-327559.1Under certain circumstances the web interface will accept characters unrelated to the expected input.CVE-2024-327566.8Under certain circumstances the Linux users credentials may be recovered by an authenticated user.CVE-2024-327576.8Under certain circumstances unnecessary user details are provided within system logs CVE-2024-327587.5Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchang CVE-2024-327597.7Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.CVE-2024-32764.8The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 do CVE-2024-327606.5When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker pr CVE-2024-327616.5Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries CVE-2024-327626.1A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to in