CVE-2024-3849

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible for authenticated attackers, with contributor access or above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-384904.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute a CVE-2024-384918.4The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.CVE-2024-384929.4This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a speciall CVE-2024-384936.1A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to cl CVE-2024-384948.6This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending CVE-2024-384955.3A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.CVE-2024-384965.1The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.CVE-2024-384998.8CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admi CVE-2024-38505.4Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on CVE-2024-385016.1An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-pri CVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential expl