# CVEs published 2024-07-20

83 CVEs were published on July 20, 2024: 1 critical, 17 high. Days are UTC.

- [CVE-2024-6932](https://cve.now/CVE-2024-6932.md): ClassCMS cross site scripting (CVSS 5.3, ClassCMS)
- [CVE-2024-6848](https://cve.now/CVE-2024-6848.md): Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload (CVSS 6.4, Post and Page Builder by BoldGrid – Visual Drag and Drop Ed…)
- [CVE-2024-37561](https://cve.now/CVE-2024-37561.md): WordPress Plugin Notes Plus plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jamie Bergen Plugin Notes Plus)
- [CVE-2024-37562](https://cve.now/CVE-2024-37562.md): WordPress Simple Post Notes plugin \<= 1.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, BracketSpace Simple Post Notes)
- [CVE-2024-37563](https://cve.now/CVE-2024-37563.md): WordPress TOCHAT.BE plugin \<= 1.3.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, TOCHAT.BE)
- [CVE-2024-37565](https://cve.now/CVE-2024-37565.md): WordPress Gum Elementor Addon plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, TemeGUM Gum Elementor Addon)
- [CVE-2024-37918](https://cve.now/CVE-2024-37918.md): WordPress ConeBlog plugin \<= 1.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPCone ConeBlog – WordPress Blog Widgets)
- [CVE-2024-37919](https://cve.now/CVE-2024-37919.md): WordPress Timeline Module for Beaver Builder plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pratik Chaskar Timeline Module for Beaver Builder)
- [CVE-2024-37920](https://cve.now/CVE-2024-37920.md): WordPress ARForms Form Builder plugin \<= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Repute InfoSystems ARForms Form Builder)
- [CVE-2024-37922](https://cve.now/CVE-2024-37922.md): WordPress Premium Addons for Elementor plugin \<= 4.10.34 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Addons for Elementor)
- [CVE-2024-37936](https://cve.now/CVE-2024-37936.md): WordPress Tabs For WPBakery Page Builder plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, labibahmed Tabs For WPBakery Page Builder)
- [CVE-2024-37943](https://cve.now/CVE-2024-37943.md): WordPress YITH WooCommerce Ajax Product Filter plugin \<= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 5.8, YITHEMES YITH WooCommerce Ajax Product Filter)
- [CVE-2024-37944](https://cve.now/CVE-2024-37944.md): WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin \<= 5.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Travel Engine)
- [CVE-2024-37946](https://cve.now/CVE-2024-37946.md): WordPress ReCaptcha Integration for WordPress plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, weDevs ReCaptcha Integration for WordPress)
- [CVE-2024-6497](https://cve.now/CVE-2024-6497.md): SEO Plugin by Squirrly SEO \<= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter (CVSS 8.8, cifi SEO Plugin by Squirrly SEO)
- [CVE-2024-37947](https://cve.now/CVE-2024-37947.md): WordPress Tutor LMS plugin \<= 2.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themeum Tutor LMS)
- [CVE-2024-37948](https://cve.now/CVE-2024-37948.md): WordPress Caxton – Create Pro page layouts in Gutenberg plugin \<= 1.30.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PootlePress Caxton – Create Pro page layouts in Gutenberg)
- [CVE-2024-37949](https://cve.now/CVE-2024-37949.md): WordPress Responsive Mobile theme \<= 1.15.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CyberChimps Responsive Mobile)
- [CVE-2024-37950](https://cve.now/CVE-2024-37950.md): WordPress Master Popups plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, CodexHelp Master Popups)
- [CVE-2024-37951](https://cve.now/CVE-2024-37951.md): WordPress Magical Posts Display plugin \<= 1.2.38 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor alam Magical Posts Display – Elementor & Gutenberg Pos…)
- [CVE-2024-37953](https://cve.now/CVE-2024-37953.md): WordPress MBE eShip plugin \<= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, MBE Worldwide S.p.A. MBE eShip)
- [CVE-2024-37954](https://cve.now/CVE-2024-37954.md): WordPress Simple Responsive Slider plugin \<= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, marcelotorres Simple Responsive Slider)
- [CVE-2024-37955](https://cve.now/CVE-2024-37955.md): WordPress GutSlider – All in One Block Slider plugin \<= 2.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zakaria Binsaifullah GutSlider – All in One Block Slider)
- [CVE-2024-37956](https://cve.now/CVE-2024-37956.md): WordPress VK All in One Expansion Unit plugin \<= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vektor VK All in One Expansion Unit)
- [CVE-2024-37957](https://cve.now/CVE-2024-37957.md): WordPress Bradmax Player plugin \<= 1.1.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bradmax Player)
- [CVE-2024-37958](https://cve.now/CVE-2024-37958.md): WordPress Meks Smart Author Widget plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Meks Smart Author Widget)
- [CVE-2024-37959](https://cve.now/CVE-2024-37959.md): WordPress Power BI Embedded for WordPress plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atlas Public Policy Power BI Embedded for WordPress)
- [CVE-2024-37960](https://cve.now/CVE-2024-37960.md): WordPress CodePen Embedded Pens Shortcode plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Coyier CodePen Embedded Pens Shortcode)
- [CVE-2024-37961](https://cve.now/CVE-2024-37961.md): WordPress codoc plugin \<= 0.9.51.12 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codoc.jp codoc)
- [CVE-2024-38669](https://cve.now/CVE-2024-38669.md): WordPress Predictive Search for WooCommerce plugin \<= 6.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, a3rev Software WooCommerce Predictive Search)
- [CVE-2024-38670](https://cve.now/CVE-2024-38670.md): WordPress Team Members plugin \<= 5.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Darko Team Members)
- [CVE-2024-38671](https://cve.now/CVE-2024-38671.md): WordPress WP GoToWebinar plugin \<= 15.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Martin Gibson WP GoToWebinar)
- [CVE-2024-38672](https://cve.now/CVE-2024-38672.md): WordPress AdPush plugin \<= 1.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, namithjawahar AdPush)
- [CVE-2024-38673](https://cve.now/CVE-2024-38673.md): WordPress Multisite Content Copier/Updater plugin \<= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Obtain Infotech Multisite Content Copier/Updater)
- [CVE-2024-38674](https://cve.now/CVE-2024-38674.md): WordPress SKT Addons for Elementor plugin \<= 3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Addons for Elementor)
- [CVE-2024-38675](https://cve.now/CVE-2024-38675.md): WordPress Arkhe Blocks plugin 2.22.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LOOS Arkhe Blocks)
- [CVE-2024-38676](https://cve.now/CVE-2024-38676.md): WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin \<= 1.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Booking Ultra Pro)
- [CVE-2024-38677](https://cve.now/CVE-2024-38677.md): WordPress REVIEWS.io plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Reviews.co.uk REVIEWS.io)
- [CVE-2024-38678](https://cve.now/CVE-2024-38678.md): WordPress Calendar.online / Kalender.digital – Plugin plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Calendar.online / Kalender.digital)
- [CVE-2024-38679](https://cve.now/CVE-2024-38679.md): WordPress Animated Typed JS Shortcode plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Yongki Agustinus Animated Typed JS Shortcode)
- [CVE-2024-38680](https://cve.now/CVE-2024-38680.md): WordPress Appmaker plugin \<= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Appmaker – Convert WooCommerce to Android & iOS Native Mobi…)
- [CVE-2024-38681](https://cve.now/CVE-2024-38681.md): WordPress Magical Addons For Elementor plugin \<= 1.1.41 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor alam Magical Addons For Elementor)
- [CVE-2024-38682](https://cve.now/CVE-2024-38682.md): WordPress Post Layouts for Gutenberg plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Techeshta Post Layouts for Gutenberg)
- [CVE-2024-38683](https://cve.now/CVE-2024-38683.md): WordPress WooCommerce Report plugin \<= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iThemelandCo WooCommerce Report)
- [CVE-2024-38684](https://cve.now/CVE-2024-38684.md): WordPress SlingBlocks plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SlingBlocks – Gutenberg Blocks by FunnelKit)
- [CVE-2024-38685](https://cve.now/CVE-2024-38685.md): WordPress WP Announcement plugin \<= 2.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SubscriptionPro WP Announcement)
- [CVE-2024-38686](https://cve.now/CVE-2024-38686.md): WordPress FancyPost plugin \<= 5.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pluginic FancyPost – Best Ultimate Post Block, Post Grid, L…)
- [CVE-2024-38687](https://cve.now/CVE-2024-38687.md): WordPress Sky Addons for Elementor plugin \<= 2.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wowDevs Sky Addons for Elementor)
- [CVE-2024-6636](https://cve.now/CVE-2024-6636.md): WooCommerce - Social Login \<= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation (CVSS 9.8, WPWeb WooCommerce - Social Login)
- [CVE-2024-6635](https://cve.now/CVE-2024-6635.md): WooCommerce - Social Login \<= 2.7.3 - Unauthenticated Authentication Bypass (CVSS 7.3, WPWeb WooCommerce - Social Login)
- [CVE-2024-38689](https://cve.now/CVE-2024-38689.md): WordPress Simple Popup plugin \<= 4.4 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Garrett Grimm Simple Popup)
- [CVE-2024-6637](https://cve.now/CVE-2024-6637.md): WooCommerce - Social Login \<= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password (CVSS 7.3, WPWeb WooCommerce - Social Login)
- [CVE-2024-38694](https://cve.now/CVE-2024-38694.md): WordPress Moloni plugin \<= 4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Moloni)
- [CVE-2024-38696](https://cve.now/CVE-2024-38696.md): WordPress Zoho CRM Lead Magnet plugin \<= 1.7.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Zoho CRM Lead Magnet)
- [CVE-2024-38697](https://cve.now/CVE-2024-38697.md): WordPress Goftino plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ali Rahimi Goftino)
- [CVE-2024-38698](https://cve.now/CVE-2024-38698.md): WordPress SKT Skill Bar plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Skill Bar)
- [CVE-2024-38703](https://cve.now/CVE-2024-38703.md): WordPress WP Event Aggregator plugin \<= 1.7.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Xylus Themes WP Event Aggregator)
- [CVE-2024-38705](https://cve.now/CVE-2024-38705.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ElementInvader Addons for Elementor)
- [CVE-2024-38710](https://cve.now/CVE-2024-38710.md): WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin \<= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jewel Theme Master Addons for Elementor)
- [CVE-2024-38711](https://cve.now/CVE-2024-38711.md): WordPress Link Library plugin \<= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yannick Lefebvre Link Library)
- [CVE-2024-38712](https://cve.now/CVE-2024-38712.md): WordPress Qi Blocks plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Qode Qi Blocks)
- [CVE-2024-38713](https://cve.now/CVE-2024-38713.md): WordPress WP Photo Album Plus plugin \<= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2024-38718](https://cve.now/CVE-2024-38718.md): WordPress Download Button for Elementor plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, clicklabs® Medienagentur Download Button for Elementor)
- [CVE-2024-38720](https://cve.now/CVE-2024-38720.md): WordPress EazyDocs plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, spider-themes EazyDocs)
- [CVE-2024-38722](https://cve.now/CVE-2024-38722.md): WordPress Job Board Manager plugin \<= 2.1.57 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Job Board Manager)
- [CVE-2024-38725](https://cve.now/CVE-2024-38725.md): WordPress Admin Dashboard RSS Feed plugin \<= 3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Webstix Admin Dashboard RSS Feed)
- [CVE-2024-38738](https://cve.now/CVE-2024-38738.md): WordPress Change From Email plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Marian Kadanka Change From Email)
- [CVE-2024-38739](https://cve.now/CVE-2024-38739.md): WordPress OnePress theme \<= 2.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.1, FameThemes OnePress)
- [CVE-2024-38741](https://cve.now/CVE-2024-38741.md): WordPress Amazing Hover Effects plugin \<= 2.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor-E-Alam Amazing Hover Effects)
- [CVE-2024-38750](https://cve.now/CVE-2024-38750.md): WordPress Advanced post slider plugin \<= 3.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, digontoahsan Advanced post slider)
- [CVE-2024-38757](https://cve.now/CVE-2024-38757.md): WordPress Typebot plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Typebot)
- [CVE-2024-38767](https://cve.now/CVE-2024-38767.md): WordPress BSK PDF Manager plugin \<= 3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BannerSky.com BSK PDF Manager)
- [CVE-2024-38758](https://cve.now/CVE-2024-38758.md): WordPress WappPress plugin \<= 6.0.4 - Blind Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, WappPress Team WappPress)
- [CVE-2024-6489](https://cve.now/CVE-2024-6489.md): Getwid – Gutenberg Blocks \<= 2.0.10 - Missing Authorization to Google API key update (CVSS 5.3, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-6491](https://cve.now/CVE-2024-6491.md): Getwid – Gutenberg Blocks \<= 2.0.10 - Missing Authentication to MailChimp API key update (CVSS 4.3, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-6694](https://cve.now/CVE-2024-6694.md): WP Mail SMTP \<= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure (CVSS 2.7, smub WP Mail SMTP by WPForms – The Most Popular SMTP and Em…)
- [CVE-2024-3934](https://cve.now/CVE-2024-3934.md): Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download (CVSS 6.5, claudiosanches Mercado Pago payments for WooCommerce)
- [CVE-2024-6281](https://cve.now/CVE-2024-6281.md): Path Traversal in parisneo/lollms (CVSS 7.3, parisneo/lollms · lollms)
- [CVE-2024-6560](https://cve.now/CVE-2024-6560.md): Addonify – Quick View For WooCommerce \<= 1.2.16 - Unauthenticated Full Path Dislcosure (CVSS 5.3, Addonify – Quick View For WooCommerce)
- [CVE-2024-2337](https://cve.now/CVE-2024-2337.md): Easy Testimonials \<= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ghuger Easy Testimonials)
- [CVE-2024-5804](https://cve.now/CVE-2024-5804.md): Conditional Fields for Contact Form 7 \<= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset (CVSS 4.3, jules-colle Conditional Fields for Contact Form)
- [CVE-2024-40347](https://cve.now/CVE-2024-40347.md): A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in th (CVSS 6.1)
- [CVE-2024-40348](https://cve.now/CVE-2024-40348.md): An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. (CVSS 8.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.