CVEs published July 20, 2024
83 CVEs were published on July 20, 2024: 1 critical, 17 high.
- Published
- 83
- Critical
- 1
- High
- 17
- Medium
- 64
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- WPWeb WooCommerce - Social Login
- 3
- jetmonsters Getwid – Gutenberg Blocks
- 2
- a3rev Software WooCommerce Predictive Search
- 1
- Addonify – Quick View For WooCommerce
- 1
- Ali Rahimi Goftino
- 1
- Appmaker – Convert WooCommerce to Android & iOS Native Mobi…
- 1
- Atlas Public Policy Power BI Embedded for WordPress
- 1
- BannerSky.com BSK PDF Manager
- 1
- Booking Ultra Pro
- 1
- BracketSpace Simple Post Notes
- 1
Critical 1
High 17
- CVE-2024-37920WordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerabilityRepute InfoSystems ARForms Form Builder
- CVE-2024-6497SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parametercifi SEO Plugin by Squirrly SEO
- CVE-2024-37953WordPress MBE eShip plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMBE Worldwide S.p.A. MBE eShip
- CVE-2024-37954WordPress Simple Responsive Slider plugin <= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitymarcelotorres Simple Responsive Slider
- CVE-2024-37961WordPress codoc plugin <= 0.9.51.12 - Cross Site Scripting (XSS) vulnerabilitycodoc.jp codoc
- CVE-2024-38669WordPress Predictive Search for WooCommerce plugin <= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilitya3rev Software WooCommerce Predictive Search
- CVE-2024-38672WordPress AdPush plugin <= 1.50 - Reflected Cross Site Scripting (XSS) vulnerabilitynamithjawahar AdPush
- CVE-2024-38673WordPress Multisite Content Copier/Updater plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityObtain Infotech Multisite Content Copier/Updater
- CVE-2024-38680WordPress Appmaker plugin <= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerabilityAppmaker – Convert WooCommerce to Android & iOS Native Mobi…
- CVE-2024-38683WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityiThemelandCo WooCommerce Report
- CVE-2024-6635WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication BypassWPWeb WooCommerce - Social Login
- CVE-2024-6637WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time PasswordWPWeb WooCommerce - Social Login
- CVE-2024-38694WordPress Moloni plugin <= 4.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityMoloni
- CVE-2024-38696WordPress Zoho CRM Lead Magnet plugin <= 1.7.8.8 - Cross Site Scripting (XSS) vulnerabilityZoho CRM Lead Magnet
- CVE-2024-38711WordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityYannick Lefebvre Link Library
- CVE-2024-6281Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-40348An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.
Medium, low and unrated 65
- CVE-2024-6932ClassCMS cross site scriptingClassCMS
- CVE-2024-6848Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File UploadPost and Page Builder by BoldGrid – Visual Drag and Drop Ed…
- CVE-2024-37561WordPress Plugin Notes Plus plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityJamie Bergen Plugin Notes Plus
- CVE-2024-37562WordPress Simple Post Notes plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerabilityBracketSpace Simple Post Notes
- CVE-2024-37563WordPress TOCHAT.BE plugin <= 1.3.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerabilityTOCHAT.BE
- CVE-2024-37565WordPress Gum Elementor Addon plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityTemeGUM Gum Elementor Addon
- CVE-2024-37918WordPress ConeBlog plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityWPCone ConeBlog – WordPress Blog Widgets
- CVE-2024-37919WordPress Timeline Module for Beaver Builder plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityPratik Chaskar Timeline Module for Beaver Builder
- CVE-2024-37922WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2024-37936WordPress Tabs For WPBakery Page Builder plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitylabibahmed Tabs For WPBakery Page Builder
- CVE-2024-37943WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Ajax Product Filter
- CVE-2024-37944WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerabilityWP Travel Engine
- CVE-2024-37946WordPress ReCaptcha Integration for WordPress plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityweDevs ReCaptcha Integration for WordPress
- CVE-2024-37947WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS
- CVE-2024-37948WordPress Caxton – Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) vulnerabilityPootlePress Caxton – Create Pro page layouts in Gutenberg
- CVE-2024-37949WordPress Responsive Mobile theme <= 1.15.1 - Cross Site Scripting (XSS) vulnerabilityCyberChimps Responsive Mobile
- CVE-2024-37950WordPress Master Popups plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityCodexHelp Master Popups
- CVE-2024-37951WordPress Magical Posts Display plugin <= 1.2.38 - Cross Site Scripting (XSS) vulnerabilityNoor alam Magical Posts Display – Elementor & Gutenberg Pos…
- CVE-2024-37955WordPress GutSlider – All in One Block Slider plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityZakaria Binsaifullah GutSlider – All in One Block Slider
- CVE-2024-37956WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerabilityVektor VK All in One Expansion Unit
- CVE-2024-37957WordPress Bradmax Player plugin <= 1.1.27 - Cross Site Scripting (XSS) vulnerabilityBradmax Player
- CVE-2024-37958WordPress Meks Smart Author Widget plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityMeks Smart Author Widget
- CVE-2024-37959WordPress Power BI Embedded for WordPress plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityAtlas Public Policy Power BI Embedded for WordPress
- CVE-2024-37960WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityChris Coyier CodePen Embedded Pens Shortcode
- CVE-2024-38670WordPress Team Members plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerabilityWP Darko Team Members
- CVE-2024-38671WordPress WP GoToWebinar plugin <= 15.7 - Cross Site Scripting (XSS) vulnerabilityMartin Gibson WP GoToWebinar
- CVE-2024-38674WordPress SKT Addons for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilitySKT Themes SKT Addons for Elementor
- CVE-2024-38675WordPress Arkhe Blocks plugin 2.22.1 - Cross Site Scripting (XSS) vulnerabilityLOOS Arkhe Blocks
- CVE-2024-38676WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilityBooking Ultra Pro
- CVE-2024-38677WordPress REVIEWS.io plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityReviews.co.uk REVIEWS.io
- CVE-2024-38678WordPress Calendar.online / Kalender.digital – Plugin plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityCalendar.online / Kalender.digital
- CVE-2024-38679WordPress Animated Typed JS Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityYongki Agustinus Animated Typed JS Shortcode
- CVE-2024-38681WordPress Magical Addons For Elementor plugin <= 1.1.41 - Cross Site Scripting (XSS) vulnerabilityNoor alam Magical Addons For Elementor
- CVE-2024-38682WordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityTecheshta Post Layouts for Gutenberg
- CVE-2024-38684WordPress SlingBlocks plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilitySlingBlocks – Gutenberg Blocks by FunnelKit
- CVE-2024-38685WordPress WP Announcement plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilitySubscriptionPro WP Announcement
- CVE-2024-38686WordPress FancyPost plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerabilityPluginic FancyPost – Best Ultimate Post Block, Post Grid, L…
- CVE-2024-38687WordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerabilitywowDevs Sky Addons for Elementor
- CVE-2024-38689WordPress Simple Popup plugin <= 4.4 - Cross-Site Scripting (XSS) vulnerabilityGarrett Grimm Simple Popup
- CVE-2024-38697WordPress Goftino plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityAli Rahimi Goftino
- CVE-2024-38698WordPress SKT Skill Bar plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilitySKT Themes SKT Skill Bar
- CVE-2024-38703WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerabilityXylus Themes WP Event Aggregator
- CVE-2024-38705WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityElementInvader Addons for Elementor
- CVE-2024-38710WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerabilityJewel Theme Master Addons for Elementor
- CVE-2024-38712WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityQode Qi Blocks
- CVE-2024-38713WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerabilityJ.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
- CVE-2024-38718WordPress Download Button for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityclicklabs® Medienagentur Download Button for Elementor
- CVE-2024-38720WordPress EazyDocs plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityspider-themes EazyDocs
- CVE-2024-38722WordPress Job Board Manager plugin <= 2.1.57 - Cross Site Scripting (XSS) vulnerabilityPickPlugins Job Board Manager
- CVE-2024-38725WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityWebstix Admin Dashboard RSS Feed
- CVE-2024-38738WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityMarian Kadanka Change From Email
- CVE-2024-38739WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerabilityFameThemes OnePress
- CVE-2024-38741WordPress Amazing Hover Effects plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabilityNoor-E-Alam Amazing Hover Effects
- CVE-2024-38750WordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerabilitydigontoahsan Advanced post slider
- CVE-2024-38757WordPress Typebot plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityTypebot
- CVE-2024-38767WordPress BSK PDF Manager plugin <= 3.6 - Cross Site Scripting (XSS) vulnerabilityBannerSky.com BSK PDF Manager
- CVE-2024-38758WordPress WappPress plugin <= 6.0.4 - Blind Server Side Request Forgery (SSRF) vulnerabilityWappPress Team WappPress
- CVE-2024-6489Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key updatejetmonsters Getwid – Gutenberg Blocks
- CVE-2024-6491Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key updatejetmonsters Getwid – Gutenberg Blocks
- CVE-2024-6694WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposuresmub WP Mail SMTP by WPForms – The Most Popular SMTP and Em…
- CVE-2024-3934Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Downloadclaudiosanches Mercado Pago payments for WooCommerce
- CVE-2024-6560Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path DislcosureAddonify – Quick View For WooCommerce
- CVE-2024-2337Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeghuger Easy Testimonials
- CVE-2024-5804Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Resetjules-colle Conditional Fields for Contact Form
- CVE-2024-40347A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in th