# CVEs published 2024-07-21

78 CVEs were published on July 21, 2024: 2 critical, 9 high. Days are UTC.

- [CVE-2024-6962](https://cve.now/CVE-2024-6962.md): Tenda O3 formQosSet stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2024-37446](https://cve.now/CVE-2024-37446.md): WordPress Chained Quiz plugin \<= 1.3.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kiboko Labs Chained Quiz)
- [CVE-2024-37447](https://cve.now/CVE-2024-37447.md): WordPress PixelYourSite plugin \<= 9.6.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, PixelYourSite – Your smart PIXEL (TAG) Manager)
- [CVE-2024-37449](https://cve.now/CVE-2024-37449.md): WordPress Slider Revolution plugin \<= 6.7.13 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThemePunch OHG Slider Revolution)
- [CVE-2024-37457](https://cve.now/CVE-2024-37457.md): WordPress Ultimate Blocks – WordPress Blocks Plugin plugin \<= 3.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ultimate Blocks – Gutenberg Blocks Plugin)
- [CVE-2024-37459](https://cve.now/CVE-2024-37459.md): WordPress PayPlus Payment Gateway plugin \<= 6.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PayPlus Payment Gateway)
- [CVE-2024-37460](https://cve.now/CVE-2024-37460.md): WordPress SuperSaaS – online appointment scheduling plugin \<= 2.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SuperSaaS – online appointment scheduling)
- [CVE-2024-37461](https://cve.now/CVE-2024-37461.md): WordPress IdeaPush plugin \<= 8.65 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Martin Gibson IdeaPush)
- [CVE-2024-37465](https://cve.now/CVE-2024-37465.md): WordPress AI Power: Complete AI Pack – Powered by GPT-4 plugin \<= 1.8.66 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Senol Sahin GPT3 AI Content Writer)
- [CVE-2024-37466](https://cve.now/CVE-2024-37466.md): WordPress Mega Elements plugin \<= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kraftplugins Mega Elements)
- [CVE-2024-37480](https://cve.now/CVE-2024-37480.md): WordPress Apollo13 Framework Extensions plugin \<= 1.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Apollo13Themes Apollo13 Framework Extensions)
- [CVE-2024-37485](https://cve.now/CVE-2024-37485.md): WordPress bbPress Notify (No-Spam) plugin \<= 2.18.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vinny Alves (UseStrict Consulting) bbPress Notify)
- [CVE-2024-38781](https://cve.now/CVE-2024-38781.md): WordPress CopySafe Web Protection plugin \<= 3.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ArtistScope CopySafe Web Protection)
- [CVE-2024-38782](https://cve.now/CVE-2024-38782.md): WordPress Leaflet Maps Marker plugin \<= 3.12.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MapsMarker.com e.U. Leaflet Maps Marker)
- [CVE-2024-38784](https://cve.now/CVE-2024-38784.md): WordPress Livemesh Addons for Beaver Builder plugin \<= 3.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Livemesh Addons for Beaver Builder)
- [CVE-2024-38785](https://cve.now/CVE-2024-38785.md): WordPress Gutenverse plugin \<= 1.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jegstudio Gutenverse)
- [CVE-2024-38786](https://cve.now/CVE-2024-38786.md): WordPress CoziPress theme \<= 1.0.30 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BurgerThemes CoziPress)
- [CVE-2024-6958](https://cve.now/CVE-2024-6958.md): itsourcecode University Management System Avatar File st\_update.php unrestricted upload (CVSS 5.3, itsourcecode University Management System)
- [CVE-2024-6957](https://cve.now/CVE-2024-6957.md): itsourcecode University Management System Login functions.php sql injection (CVSS 6.9, itsourcecode University Management System)
- [CVE-2024-6956](https://cve.now/CVE-2024-6956.md): itsourcecode University Management System view\_cgpa.php sql injection (CVSS 5.3, itsourcecode University Management System)
- [CVE-2024-6955](https://cve.now/CVE-2024-6955.md): SourceCodester Record Management System sort2.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6954](https://cve.now/CVE-2024-6954.md): SourceCodester Record Management System sort1.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6953](https://cve.now/CVE-2024-6953.md): itsourcecode Tailoring Management System sms.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-6952](https://cve.now/CVE-2024-6952.md): itsourcecode University Management System sql injection (CVSS 5.3, itsourcecode University Management System)
- [CVE-2024-6951](https://cve.now/CVE-2024-6951.md): SourceCodester Simple Online Book Store System admin\_delete.php sql injection (CVSS 5.3, SourceCodester Simple Online Book Store System)
- [CVE-2024-6961](https://cve.now/CVE-2024-6961.md): XXE in Guardrails AI when consuming RAIL documents (CVSS 5.9, guardrails-ai)
- [CVE-2024-6950](https://cve.now/CVE-2024-6950.md): Prain HTTP POST Request ?import code injection (CVSS 5.3, Prain)
- [CVE-2024-6949](https://cve.now/CVE-2024-6949.md): Gargaj wuhu path traversal (CVSS 5.3, Gargaj wuhu)
- [CVE-2024-6960](https://cve.now/CVE-2024-6960.md): H2O deserializes ML models without filtering, potentially allowing execution of malicious code (CVSS 7.5, ai.h2o:h2o-core)
- [CVE-2024-6948](https://cve.now/CVE-2024-6948.md): Gargaj wuhu Slide Editor slideeditor.php unrestricted upload (CVSS 5.3, Gargaj wuhu)
- [CVE-2024-6947](https://cve.now/CVE-2024-6947.md): Flute CMS Notification ContentParser.php replaceContent code injection (CVSS 5.1, Flute CMS)
- [CVE-2024-6946](https://cve.now/CVE-2024-6946.md): Flute CMS list code injection (CVSS 5.1, Flute CMS)
- [CVE-2024-6945](https://cve.now/CVE-2024-6945.md): Flute CMS Avatar Upload Page ImagesController.php unrestricted upload (CVSS 5.3, Flute CMS)
- [CVE-2024-37487](https://cve.now/CVE-2024-37487.md): WordPress WP Directory Kit plugin \<= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpdirectorykit.com WP Directory Kit)
- [CVE-2024-6944](https://cve.now/CVE-2024-6944.md): ZhongBangKeJi CRMEB PublicController.php get\_image\_base64 deserialization (CVSS 5.3, ZhongBangKeJi CRMEB)
- [CVE-2024-37488](https://cve.now/CVE-2024-37488.md): WordPress HelloAsso plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HelloAsso)
- [CVE-2024-37489](https://cve.now/CVE-2024-37489.md): WordPress Ocean Extra plugin \<= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5, OceanWP Ocean Extra)
- [CVE-2024-37492](https://cve.now/CVE-2024-37492.md): WordPress Gutenberg plugin \<= 18.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gutenberg Team Gutenberg)
- [CVE-2024-37495](https://cve.now/CVE-2024-37495.md): WordPress Create by Mediavine plugin \<= 1.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, mischiefmarmot Create by Mediavine)
- [CVE-2024-37500](https://cve.now/CVE-2024-37500.md): WordPress Beaver Builder plugin \<= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, The Beaver Builder Team Beaver Builder)
- [CVE-2024-37507](https://cve.now/CVE-2024-37507.md): WordPress Eventin plugin \<= 3.3.57 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themewinter Eventin)
- [CVE-2024-38438](https://cve.now/CVE-2024-38438.md): D-Link - CWE-294: Authentication Bypass by Capture-replay (CVSS 9.8, D-Link DSL-225)
- [CVE-2024-37509](https://cve.now/CVE-2024-37509.md): WordPress MakeCommerce for WooCommerce plugin \<= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Maksekeskus AS MakeCommerce for WooCommerce)
- [CVE-2024-37512](https://cve.now/CVE-2024-37512.md): WordPress NEX-Forms – Ultimate Form Builder plugin \<= 8.5.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Basix NEX-Forms – Ultimate Form Builder)
- [CVE-2024-38437](https://cve.now/CVE-2024-38437.md): D-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, D-Link DSL-225)
- [CVE-2024-37514](https://cve.now/CVE-2024-37514.md): WordPress CopySafe Web Protection plugin \<= 3.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ArtistScope CopySafe Web Protection)
- [CVE-2024-37515](https://cve.now/CVE-2024-37515.md): WordPress XPlainer – WooCommerce Product FAQ \[WooCommerce Accordion FAQ Plugin\] plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, Optemiz XPlainer - WooCommerce Product FAQ)
- [CVE-2024-37519](https://cve.now/CVE-2024-37519.md): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin \<= 2.1.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2024-38436](https://cve.now/CVE-2024-38436.md): Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 6.1, Commugen SOX)
- [CVE-2024-37521](https://cve.now/CVE-2024-37521.md): WordPress zBench theme \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, zwwooooo zBench)
- [CVE-2024-37522](https://cve.now/CVE-2024-37522.md): WordPress CC & BCC for Woocommerce Order Emails plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Dario Curasì CC & BCC for Woocommerce Order Emails)
- [CVE-2024-38435](https://cve.now/CVE-2024-38435.md): Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions (CVSS 6.5, Unitronics Vision PLC)
- [CVE-2024-37523](https://cve.now/CVE-2024-37523.md): WordPress Login Logo Editor plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AMP-MODE Login Logo Editor)
- [CVE-2024-38434](https://cve.now/CVE-2024-38434.md): Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function (CVSS 6.5, Unitronics Vision PLC)
- [CVE-2024-37536](https://cve.now/CVE-2024-37536.md): WordPress Easy Custom Code (LESS/CSS/JS) Plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Web357 Easy Custom Code (LESS/CSS/JS) – Live editing)
- [CVE-2024-37537](https://cve.now/CVE-2024-37537.md): WordPress WS Contact Form plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, UusWeb.ee WS Contact Form)
- [CVE-2024-37538](https://cve.now/CVE-2024-37538.md): WordPress Link To Bible plugin \<= 2.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Thomas Kuhlmann Link To Bible)
- [CVE-2024-37545](https://cve.now/CVE-2024-37545.md): WordPress Floating Social Media Links plugin \<= 1.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nick Halsey Floating Social Media Links)
- [CVE-2024-37548](https://cve.now/CVE-2024-37548.md): WordPress Meks Easy Ads Widget plugin \<= 2.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Meks Easy Ads Widget)
- [CVE-2024-37549](https://cve.now/CVE-2024-37549.md): WordPress Save as PDF plugin by Pdfcrowd plugin \<= 4.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Save as PDF plugin by Pdfcrowd)
- [CVE-2024-6943](https://cve.now/CVE-2024-6943.md): ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization (CVSS 5.3, ZhongBangKeJi CRMEB)
- [CVE-2024-37550](https://cve.now/CVE-2024-37550.md): WordPress Template Kit – Export plugin \<= 1.0.22 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Envato Template Kit – Export)
- [CVE-2024-37551](https://cve.now/CVE-2024-37551.md): WordPress Simple Social Share plugin \<= 3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Perials Simple Social Share)
- [CVE-2024-37552](https://cve.now/CVE-2024-37552.md): WordPress Social Media Share Buttons & Social Sharing Icons plugin \<= 2.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Inisev Social Media & Share Icons)
- [CVE-2024-37556](https://cve.now/CVE-2024-37556.md): WordPress WordPress Notification Bar plugin \<= 1.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, SeedProd WordPress Notification Bar)
- [CVE-2024-37557](https://cve.now/CVE-2024-37557.md): WordPress WP Cookie Law Info plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Soham Web Solution WP Cookie Law Info)
- [CVE-2024-37558](https://cve.now/CVE-2024-37558.md): WordPress WPFavicon plugin \<= 2.1.1 - Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Nazmul Hossain Nihal WPFavicon)
- [CVE-2024-37559](https://cve.now/CVE-2024-37559.md): WordPress counterpoint theme \<= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Echenley Counterpoint)
- [CVE-2024-6942](https://cve.now/CVE-2024-6942.md): ThinkSAAS Admin Panel Security Center anti.php cross site scripting (CVSS 5.3, ThinkSAAS)
- [CVE-2024-6941](https://cve.now/CVE-2024-6941.md): ThinkSAAS do.php cross site scripting (CVSS 5.3, ThinkSAAS)
- [CVE-2024-6940](https://cve.now/CVE-2024-6940.md): DedeCMS article\_template\_rand.php code injection (CVSS 5.1, DedeCMS)
- [CVE-2024-6939](https://cve.now/CVE-2024-6939.md): Xinhu RockOA tpl\_upload.html okla cross site scripting (CVSS 5.3, Xinhu RockOA)
- [CVE-2024-6938](https://cve.now/CVE-2024-6938.md): SiYuan PDF PDF.js cross site scripting (CVSS 5.3, SiYuan)
- [CVE-2024-6937](https://cve.now/CVE-2024-6937.md): formtools.org Form Tools Import Option List edit.php curl\_exec file inclusion (CVSS 5.1, formtools.org Form Tools)
- [CVE-2024-6936](https://cve.now/CVE-2024-6936.md): formtools.org Form Tools Setting code injection (CVSS 5.1, formtools.org Form Tools)
- [CVE-2024-6935](https://cve.now/CVE-2024-6935.md): formtools.org Form Tools User Settings Page cross site scripting (CVSS 5.1, formtools.org Form Tools)
- [CVE-2024-6934](https://cve.now/CVE-2024-6934.md): formtools.org Form Tools cross site scripting (CVSS 5.1, formtools.org Form Tools)
- [CVE-2024-6933](https://cve.now/CVE-2024-6933.md): LimeSurvey Survey General Settings updatesurveylocalesettings\_generalsettings actionUpdateSurveyLocaleSettingsGeneralSettings sql injection (CVSS 5.3, LimeSurvey)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.