# CVEs published 2024-07-27 29 CVEs were published on July 27, 2024: 0 critical, 4 high. Days are UTC. - [CVE-2024-7153](https://cve.now/CVE-2024-7153.md): Netgear WN604 siteSurvey.php direct request (CVSS 6.9, Netgear WN604) - [CVE-2024-7152](https://cve.now/CVE-2024-7152.md): Tenda O3 setMacFilterList fromSafeSetMacFilter stack-based overflow (CVSS 8.7, Tenda O3) - [CVE-2024-7151](https://cve.now/CVE-2024-7151.md): Tenda O3 setMacFilter fromMacFilterSet stack-based overflow (CVSS 8.7, Tenda O3) - [CVE-2024-6703](https://cve.now/CVE-2024-6703.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields (CVSS 4.9, techjewel Fluent Forms – Customizable Contact Forms, Survey…) - [CVE-2024-6518](https://cve.now/CVE-2024-6518.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…) - [CVE-2024-6520](https://cve.now/CVE-2024-6520.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…) - [CVE-2024-6897](https://cve.now/CVE-2024-6897.md): aThemes Starter Sites \<= 1.0.53 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, smub aThemes Starter Sites) - [CVE-2024-6521](https://cve.now/CVE-2024-6521.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…) - [CVE-2024-6627](https://cve.now/CVE-2024-6627.md): Happy Addons for Elementor \<= 3.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor) - [CVE-2024-5614](https://cve.now/CVE-2024-5614.md): Piotnet Addons For Elementor \<= 2.4.29 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, piotnetdotcom Piotnet Addons For Elementor) - [CVE-2024-6458](https://cve.now/CVE-2024-6458.md): WooCommerce Product Table Lite \<= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, wcproducttable Product Table and List Builder for WooCommer…) - [CVE-2024-6569](https://cve.now/CVE-2024-6569.md): Campaign Monitor for WordPress \<= 2.8.15 - Unauthenticated Full Path Disclosure (CVSS 5.3, vibhorchhabra Campaign Monitor for WordPress) - [CVE-2024-5969](https://cve.now/CVE-2024-5969.md): AIomatic - Automatic AI Content Writer \<= 2.0.5 - Unauthenticated Arbitrary Email Sending (CVSS 5.8, CodeRevolution Aiomatic - Automatic AI Content Writer & Edi…) - [CVE-2024-6546](https://cve.now/CVE-2024-6546.md): One Click Close Comments \<= 2.7.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code One Click Close Comments) - [CVE-2024-6634](https://cve.now/CVE-2024-6634.md): Master Currency WP \<= 1.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via Currency Converter Form Shortcode (CVSS 6.4, wibergsweb Master Currency WP) - [CVE-2024-6661](https://cve.now/CVE-2024-6661.md): ParityPress \<= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, paritydiscounts ParityPress – Parity Pricing with Discount…) - [CVE-2024-6566](https://cve.now/CVE-2024-6566.md): Aramex Shipping WooCommerce \<= 1.1.21 - Unauthenticated Full Path Disclosure (CVSS 5.3, Aramex Shipping WooCommerce) - [CVE-2024-6549](https://cve.now/CVE-2024-6549.md): Admin Post Navigation \<= 2.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Admin Post Navigation) - [CVE-2024-6573](https://cve.now/CVE-2024-6573.md): Intelligence \<= 1.4.0 - Unauthenticated Full Path Disclosure (CVSS 5.3, tomdude Intelligence) - [CVE-2024-6545](https://cve.now/CVE-2024-6545.md): Admin Trim Interface \<= 3.5.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Admin Trim Interface) - [CVE-2024-6431](https://cve.now/CVE-2024-6431.md): Media.net Ads Manager \<= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, mnetadmanager Media.net Ads Manager) - [CVE-2024-6591](https://cve.now/CVE-2024-6591.md): Ultimate WordPress Auction Plugin \<= 4.2.7 - Missing Authorization to Unauthenticated Email Creation (CVSS 5.8, nitesh\_singh Ultimate WordPress Auction Plugin) - [CVE-2024-6548](https://cve.now/CVE-2024-6548.md): Add Admin JavaScript \<= 2.0 - Unauthenticated Full Path Dislcosure (CVSS 5.3, coffee2code Add Admin JavaScript) - [CVE-2024-6152](https://cve.now/CVE-2024-6152.md): Flipbox Builder \<= 1.5 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, wptexture Flipbox Builder) - [CVE-2024-1798](https://cve.now/CVE-2024-1798.md): Tutor LMS – Migration Tool \<= 2.2.0 - Missing Authorization in tutor\_lp\_export\_xml (CVSS 5.3, themeum Tutor LMS – Migration Tool) - [CVE-2024-1804](https://cve.now/CVE-2024-1804.md): Tutor LMS – Migration Tool \<= 2.2.0 - Missing Authorization in tutor\_import\_from\_xml (CVSS 4.3, themeum Tutor LMS – Migration Tool) - [CVE-2024-4410](https://cve.now/CVE-2024-4410.md): IgnitionDeck Crowdfunding Platform \<= 1.9.8 - Missing Authorization (CVSS 5.4, ignitionwp IgnitionDeck Crowdfunding Platform) - [CVE-2024-6547](https://cve.now/CVE-2024-6547.md): Add Admin CSS \<= 2.0.1 - Unauthenticated Full Path Dislcosure (CVSS 5.3, coffee2code Add Admin CSS) - [CVE-2024-42029](https://cve.now/CVE-2024-42029.md): xdg-desktop-portal-hyprland (aka an XDG Desktop Portal backend for Hyprland) before 1.3.3 allows OS command execution, e.g., because single (CVSS 6.3) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-07-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.