CVEs published July 13, 2024
49 CVEs were published on July 13, 2024: 1 critical, 8 high.
- Published
- 49
- Critical
- 1
- High
- 8
- Medium
- 40
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- wp-eMember
- 8
- wp-affiliate-platform
- 7
- SULly
- 4
- If-So Dynamic Content Personalization
- 2
- openjpeg · Red Hat AI Inference Server +1
- 2
- Tournamatch
- 2
- Bug Library
- 1
- CM Email Registration Blacklist and Whitelist
- 1
- CM WordPress Search And Replace Plugin
- 1
- Ditty
- 1
Critical 1
High 8
- CVE-2024-5715WP eMember < 10.6.7 - Reflected XSS via Member Editwp-eMember
- CVE-2024-5472WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color fieldWP QuickLaTeX
- CVE-2024-5287WP Affiliate Platform < 6.5.1 - Profile Update via CSRFwp-affiliate-platform
- CVE-2024-5167CM Email Registration Blacklist and Whitelist < 1.4.9 - Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelistCM Email Registration Blacklist and Whitelist
- CVE-2024-5151SULly < 4.3.1 - Admin+ Stored XSSSULly
- CVE-2024-5080WP eMember < 10.6.6 - Admin+ Arbitrary File Uploadwp-eMember
- CVE-2024-5076WP eMember < 10.6.6 - Bulk Delete via CSRFwp-eMember
- CVE-2024-5034SULly < 4.3.1 - Plugin Reset via CSRFSULly
Medium, low and unrated 40
- CVE-2024-6465WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Updaterico-macchi WP Links Page
- CVE-2024-6070if-so < 1.8.0.4 - Admin+ Stored XSSIf-So Dynamic Content Personalization
- CVE-2024-5744WP eMember < 10.6.7 - Reflected XSSwp-eMember
- CVE-2024-5713if-so < 1.8.0.4 - Reflected XSSIf-So Dynamic Content Personalization
- CVE-2024-5644WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via LaddersTournamatch
- CVE-2024-5627WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSSTournamatch
- CVE-2024-5575Ditty < 3.1.43 - Author+ Stored XSSDitty
- CVE-2024-5442NextGEN Gallery < 3.59.3 - Admin+ Stored XSSPhoto Gallery, Sliders, Proofing and Themes
- CVE-2024-5286WP Affiliate Platform < 6.5.1 - Reflected XSS via Banner Editingwp-affiliate-platform
- CVE-2024-5284WP Affiliate Platform < 6.5.1 - Stored XSS via CSRFwp-affiliate-platform
- CVE-2024-5283WP Affiliate Platform < 6.5.1 - Reflected XSS via Lead Editingwp-affiliate-platform
- CVE-2024-5282WP Affiliate Platform < 6.5.1 - Reflected XSS via Registration Formwp-affiliate-platform
- CVE-2024-5281WP Affiliate Platform < 6.5.1 - Reflected XSS via Affiliate Editingwp-affiliate-platform
- CVE-2024-5280WP Affiliate Platform < 6.5.1 - POST Reflected XSSwp-affiliate-platform
- CVE-2024-5079WP eMember < 10.6.7 - Unauthenticated Stored XSS via Member Registrationwp-eMember
- CVE-2024-5077WP eMember < 10.6.6 - Stored XSS in Blacklist via CSRFwp-eMember
- CVE-2024-5075WP eMember < 10.6.6 - Reflected XSSwp-eMember
- CVE-2024-5074WP eMember < 10.6.6 - Reflected XSSwp-eMember
- CVE-2024-5033SULly < 4.3.1 - Admin+ Stored XSS via CSRFSULly
- CVE-2024-5032SULly < 4.3.1 - Reflected XSSSULly
- CVE-2024-5028CM WordPress Search And Replace Plugin < 1.3.9 - Plugin Reset via CSRFCM WordPress Search And Replace Plugin
- CVE-2024-5002User Submitted Posts < 20240516 - Admin+ Stored XSSUser Submitted Posts
- CVE-2024-4977Index WP MySQL For Speed < 1.4.18 - Admin+ Reflected XSSIndex WP MySQL For Speed
- CVE-2024-4752EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitleEventON
- CVE-2024-4602Embed Peertube Playlist < 1.10 - Editor+ Stored XSSEmbed Peertube Playlist
- CVE-2024-4272Support SVG < 1.1.0 - Stored XSS via SVG UploadSupport SVG
- CVE-2024-4269SVG Block < 1.1.20 - Author+ Stored XSS via SVG File UploadSVG Block
- CVE-2024-4217Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSSshortcodes-ultimate-pro
- CVE-2024-3964Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSSProduct Enquiry for WooCommerce
- CVE-2024-3963RafflePress Lite < 1.12.14 - Editor+ Stored XSSGiveaways and Contests by RafflePress
- CVE-2024-3919OpenPGP Form Encryption for WordPress < 1.5.1 - Contributor+ Stored XSSOpenPGP Form Encryption for WordPress
- CVE-2024-3753Hostel < 1.1.5.3 - Reflected XSSHostel
- CVE-2024-3751Seriously Simple Podcasting < 3.3.0 - Admin+ Stored XSSSeriously Simple Podcasting
- CVE-2024-3710Image Photo Gallery Final Tiles Grid < 3.6.0 - Contributor+ Stored XSSImage Photo Gallery Final Tiles Grid
- CVE-2024-3632Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRFSmart Image Gallery
- CVE-2024-3026WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSSWordPress Button Plugin MaxButtons
- CVE-2024-2870Swift Framework < 2024.04.30 - Reflected XSSsocialdriver-framework
- CVE-2024-6574Laposta <= 1.12 - Unauthenticated Full Path Disclosurestijnvanderree Laposta
- CVE-2023-39329Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.copenjpeg · Red Hat AI Inference Server +1
- CVE-2023-39327Openjpeg: malicious files can cause the program to enter a large loopopenjpeg · Red Hat AI Inference Server +1