CVE-2024-3734

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 1.4.1.8. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on what other plugins are installed and what shortcode functionality they provide.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-373408.8Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityCVE-2024-373419.8Microsoft SQL Server Elevation of Privilege VulnerabilityCVE-2024-373424.3Microsoft SQL Server Native Scoring Information Disclosure VulnerabilityCVE-2024-373435.4There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. CVE-2024-373443.4There is a cross-site scripting vulnerability in the Policy management UI of Absolute Secure Access prior to version 13.06. Attackers with sCVE-2024-373455.4There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. AttacCVE-2024-373464.9There is an insufficient input validation vulnerability in the Warehouse component of Absolute Secure Access prior to 13.06. Attackers with CVE-2024-373473.4There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13CVE-2024-373483.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system aCVE-2024-373493.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system aCVE-2024-37353.7A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the fileCVE-2024-373504.7There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can in
CVE-2024-3734: Medium severity, CVSS 6.5 | Vulnix