# CVEs published 2024-07-13

49 CVEs were published on July 13, 2024: 1 critical, 8 high. Days are UTC.

- [CVE-2024-6465](https://cve.now/CVE-2024-6465.md): WP Links Page \<= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update (CVSS 4.3, rico-macchi WP Links Page)
- [CVE-2024-6070](https://cve.now/CVE-2024-6070.md): if-so \< 1.8.0.4 - Admin+ Stored XSS (CVSS 4.8, If-So Dynamic Content Personalization)
- [CVE-2024-5744](https://cve.now/CVE-2024-5744.md): WP eMember \< 10.6.7 - Reflected XSS (CVSS 6.8, wp-eMember)
- [CVE-2024-5715](https://cve.now/CVE-2024-5715.md): WP eMember \< 10.6.7 - Reflected XSS via Member Edit (CVSS 7.1, wp-eMember)
- [CVE-2024-5713](https://cve.now/CVE-2024-5713.md): if-so \< 1.8.0.4 - Reflected XSS (CVSS 5.4, If-So Dynamic Content Personalization)
- [CVE-2024-5644](https://cve.now/CVE-2024-5644.md): WordPress Plugin Tournamatch \< 4.6.1 - Admin+ Stored XSS via Ladders (CVSS 5.4, Tournamatch)
- [CVE-2024-5627](https://cve.now/CVE-2024-5627.md): WordPress Plugin Tournamatch \< 4.6.1 - Subscriber+ Stored XSS (CVSS 5.4, Tournamatch)
- [CVE-2024-5575](https://cve.now/CVE-2024-5575.md): Ditty \< 3.1.43 - Author+ Stored XSS (CVSS 4.7, Ditty)
- [CVE-2024-5472](https://cve.now/CVE-2024-5472.md): WP QuickLaTeX \< 3.8.7 - Admin+ Stored XSS in Background Color field (CVSS 7.1, WP QuickLaTeX)
- [CVE-2024-5450](https://cve.now/CVE-2024-5450.md): Bug Library \< 2.1.1 - Unauthenticated RCE (CVSS 9.1, Bug Library)
- [CVE-2024-5442](https://cve.now/CVE-2024-5442.md): NextGEN Gallery \< 3.59.3 - Admin+ Stored XSS (CVSS 5.9, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2024-5287](https://cve.now/CVE-2024-5287.md): WP Affiliate Platform \< 6.5.1 - Profile Update via CSRF (CVSS 7.1, wp-affiliate-platform)
- [CVE-2024-5286](https://cve.now/CVE-2024-5286.md): WP Affiliate Platform \< 6.5.1 - Reflected XSS via Banner Editing (CVSS 4.8, wp-affiliate-platform)
- [CVE-2024-5284](https://cve.now/CVE-2024-5284.md): WP Affiliate Platform \< 6.5.1 - Stored XSS via CSRF (CVSS 6.8, wp-affiliate-platform)
- [CVE-2024-5283](https://cve.now/CVE-2024-5283.md): WP Affiliate Platform \< 6.5.1 - Reflected XSS via Lead Editing (CVSS 6.1, wp-affiliate-platform)
- [CVE-2024-5282](https://cve.now/CVE-2024-5282.md): WP Affiliate Platform \< 6.5.1 - Reflected XSS via Registration Form (CVSS 6.1, wp-affiliate-platform)
- [CVE-2024-5281](https://cve.now/CVE-2024-5281.md): WP Affiliate Platform \< 6.5.1 - Reflected XSS via Affiliate Editing (CVSS 6.1, wp-affiliate-platform)
- [CVE-2024-5280](https://cve.now/CVE-2024-5280.md): WP Affiliate Platform \< 6.5.1 - POST Reflected XSS (CVSS 4.7, wp-affiliate-platform)
- [CVE-2024-5167](https://cve.now/CVE-2024-5167.md): CM Email Registration Blacklist and Whitelist \< 1.4.9 - Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist (CVSS 8.1, CM Email Registration Blacklist and Whitelist)
- [CVE-2024-5151](https://cve.now/CVE-2024-5151.md): SULly \< 4.3.1 - Admin+ Stored XSS (CVSS 7.1, SULly)
- [CVE-2024-5080](https://cve.now/CVE-2024-5080.md): WP eMember \< 10.6.6 - Admin+ Arbitrary File Upload (CVSS 8.8, wp-eMember)
- [CVE-2024-5079](https://cve.now/CVE-2024-5079.md): WP eMember \< 10.6.7 - Unauthenticated Stored XSS via Member Registration (CVSS 6.1, wp-eMember)
- [CVE-2024-5077](https://cve.now/CVE-2024-5077.md): WP eMember \< 10.6.6 - Stored XSS in Blacklist via CSRF (CVSS 6.8, wp-eMember)
- [CVE-2024-5076](https://cve.now/CVE-2024-5076.md): WP eMember \< 10.6.6 - Bulk Delete via CSRF (CVSS 8.8, wp-eMember)
- [CVE-2024-5075](https://cve.now/CVE-2024-5075.md): WP eMember \< 10.6.6 - Reflected XSS (CVSS 5.9, wp-eMember)
- [CVE-2024-5074](https://cve.now/CVE-2024-5074.md): WP eMember \< 10.6.6 - Reflected XSS (CVSS 5.4, wp-eMember)
- [CVE-2024-5034](https://cve.now/CVE-2024-5034.md): SULly \< 4.3.1 - Plugin Reset via CSRF (CVSS 8.8, SULly)
- [CVE-2024-5033](https://cve.now/CVE-2024-5033.md): SULly \< 4.3.1 - Admin+ Stored XSS via CSRF (CVSS 5.9, SULly)
- [CVE-2024-5032](https://cve.now/CVE-2024-5032.md): SULly \< 4.3.1 - Reflected XSS (CVSS 4.7, SULly)
- [CVE-2024-5028](https://cve.now/CVE-2024-5028.md): CM WordPress Search And Replace Plugin \< 1.3.9 - Plugin Reset via CSRF (CVSS 6.5, CM WordPress Search And Replace Plugin)
- [CVE-2024-5002](https://cve.now/CVE-2024-5002.md): User Submitted Posts \< 20240516 - Admin+ Stored XSS (CVSS 4.8, User Submitted Posts)
- [CVE-2024-4977](https://cve.now/CVE-2024-4977.md): Index WP MySQL For Speed \< 1.4.18 - Admin+ Reflected XSS (CVSS 6.8, Index WP MySQL For Speed)
- [CVE-2024-4752](https://cve.now/CVE-2024-4752.md): EventON \< 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle (CVSS 5.9, EventON)
- [CVE-2024-4602](https://cve.now/CVE-2024-4602.md): Embed Peertube Playlist \< 1.10 - Editor+ Stored XSS (CVSS 5.4, Embed Peertube Playlist)
- [CVE-2024-4272](https://cve.now/CVE-2024-4272.md): Support SVG \< 1.1.0 - Stored XSS via SVG Upload (CVSS 6.1, Support SVG)
- [CVE-2024-4269](https://cve.now/CVE-2024-4269.md): SVG Block \< 1.1.20 - Author+ Stored XSS via SVG File Upload (CVSS 6.1, SVG Block)
- [CVE-2024-4217](https://cve.now/CVE-2024-4217.md): Shortcodes Ultimate Pro \< 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS (CVSS 4.7, shortcodes-ultimate-pro)
- [CVE-2024-3964](https://cve.now/CVE-2024-3964.md): Product Enquiry for WooCommerce \< 3.1.8 - Admin+ Stored XSS (CVSS 5.9, Product Enquiry for WooCommerce)
- [CVE-2024-3963](https://cve.now/CVE-2024-3963.md): RafflePress Lite \< 1.12.14 - Editor+ Stored XSS (CVSS 6.5, Giveaways and Contests by RafflePress)
- [CVE-2024-3919](https://cve.now/CVE-2024-3919.md): OpenPGP Form Encryption for WordPress \< 1.5.1 - Contributor+ Stored XSS (CVSS 4.6, OpenPGP Form Encryption for WordPress)
- [CVE-2024-3753](https://cve.now/CVE-2024-3753.md): Hostel \< 1.1.5.3 - Reflected XSS (CVSS 5.9, Hostel)
- [CVE-2024-3751](https://cve.now/CVE-2024-3751.md): Seriously Simple Podcasting \< 3.3.0 - Admin+ Stored XSS (CVSS 4.8, Seriously Simple Podcasting)
- [CVE-2024-3710](https://cve.now/CVE-2024-3710.md): Image Photo Gallery Final Tiles Grid \< 3.6.0 - Contributor+ Stored XSS (CVSS 6.8, Image Photo Gallery Final Tiles Grid)
- [CVE-2024-3632](https://cve.now/CVE-2024-3632.md): Smart Image Gallery \< 1.0.19 - Update/Delete Google API Key via CSRF (CVSS 6.8, Smart Image Gallery)
- [CVE-2024-3026](https://cve.now/CVE-2024-3026.md): WordPress Button Plugin MaxButtons \< 9.7.8 - Editor+ Stored XSS (CVSS 5.4, WordPress Button Plugin MaxButtons)
- [CVE-2024-2870](https://cve.now/CVE-2024-2870.md): Swift Framework \< 2024.04.30 - Reflected XSS (CVSS 6.1, socialdriver-framework)
- [CVE-2024-6574](https://cve.now/CVE-2024-6574.md): Laposta \<= 1.12 - Unauthenticated Full Path Disclosure (CVSS 5.3, stijnvanderree Laposta)
- [CVE-2023-39329](https://cve.now/CVE-2023-39329.md): Openjpeg: resource exhaustion will occur in the opj\_t1\_decode\_cblks function in the tcd.c (CVSS 6.5, openjpeg · Red Hat AI Inference Server +1)
- [CVE-2023-39327](https://cve.now/CVE-2023-39327.md): Openjpeg: malicious files can cause the program to enter a large loop (CVSS 4.3, openjpeg · Red Hat AI Inference Server +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.