CVEs published August 18, 2024
66 CVEs were published on August 18, 2024: 0 critical, 20 high.
- Published
- 66
- Critical
- 0
- High
- 20
- Medium
- 46
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- DedeBIZ
- 4
- CodeAstro Online Railway Reservation System
- 2
- TOTOLINK EX1200L
- 2
- all_bootstrap_blocks All Bootstrap Blocks
- 1
- Automattic Sensei LMS · Automattic Sensei Pro
- 1
- Automattic WooCommerce
- 1
- AyeCode GeoDirectory
- 1
- azzaroco Ultimate Membership Pro
- 1
- BdThemes Ultimate Store Kit Elementor Addons
- 1
- BoldThemes Bold Timeline Lite
- 1
High 20
- CVE-2024-43145WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerabilityAyeCode GeoDirectory
- CVE-2024-43207WordPress Unite Gallery Lite plugin <= 1.7.62 - SQL Injection vulnerabilityValiano Unite Gallery Lite
- CVE-2024-43282WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerabilityThemeum Tutor LMS
- CVE-2024-43286WordPress Squirrly SEO plugin <= 12.3.19 - SQL Injection vulnerabilitySEO Plugin by Squirrly SEO
- CVE-2024-43315WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerabilityCheckout Plugins Stripe Payments For WooCommerce by Checkout
- CVE-2024-43241WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Reflected Cross Site Scripting (XSS) vulnerabilityazzaroco Ultimate Membership Pro
- CVE-2024-43244WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez
- CVE-2024-43246WordPress WHMpress plugin <= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerabilitycreativeon WHMpress
- CVE-2024-43279WordPress Newsletters plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerabilityTribulant Newsletters
- CVE-2024-43303WordPress White Label CMS plugin <= 2.7.4 - Reflected Cross Site Scripting (XSS) vulnerabilityvideousermanuals.com White Label CMS
- CVE-2024-43304WordPress Cryptocurrency Widgets plugin <= 2.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCool Plugins Cryptocurrency Widgets – Price Ticker & Coins…
- CVE-2024-7909TOTOLINK EX1200L cstecgi.cgi setLanguageCfg stack-based overflowTOTOLINK EX1200L
- CVE-2024-7908TOTOLINK EX1200L cstecgi.cgi setDefResponse stack-based overflowTOTOLINK EX1200L
- CVE-2024-43306WordPress WP-Lister Lite for eBay plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2024-43313WordPress FormFacade plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitymanidoraisamy FormFacade
- CVE-2024-43327WordPress Invite Anyone plugin <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityBoone Gorges Invite Anyone
- CVE-2024-43330WordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack for Beaver Builder
- CVE-2024-43238WordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerabilityweDevs weMail
- CVE-2024-43276WordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilitySvetoslav Marinov (Slavi) Child Theme Creator
- CVE-2024-43348WordPress Purity Of Soul theme <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityIznyn Purity Of Soul
Medium, low and unrated 46
- CVE-2024-7917DouPHP Favicon system.php unrestricted uploadDouPHP
- CVE-2024-7916nafisulbari/itsourcecode Insurance Management System Add Nominee Page addNominee.php cross site scriptingnafisulbari Insurance Management System · itsourcecode Insu…
- CVE-2024-7914SourceCodester Yoga Class Registration System SystemSettings.php cross site scriptingSourceCodester Yoga Class Registration System
- CVE-2024-7913itsourcecode Billing System addclient1.php sql injectionitsourcecode Billing System
- CVE-2024-35686WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerabilityAutomattic Sensei LMS · Automattic Sensei Pro
- CVE-2024-43239WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerabilityMasteriyo - LMS
- CVE-2024-43266WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerabilitywpjobportal WP Job Portal
- CVE-2024-43288WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerabilitygVectors Team wpForo Forum
- CVE-2024-43322WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerabilityDylan James Zephyr Project Manager
- CVE-2024-7912CodeAstro Online Railway Reservation System assets exposure of information through directory listingCodeAstro Online Railway Reservation System
- CVE-2024-43350WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerabilityPropovoice CRM
- CVE-2024-43262WordPress Busiprof theme <= 2.4.8 - Cross Site Scripting (XSS) vulnerabilitywebriti Busiprof
- CVE-2024-43263WordPress Visual Composer Starter theme <= 3.3 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Starter
- CVE-2024-43267WordPress Mega Addons For Elementor plugin <= 1.9 - Cross Site Scripting (XSS) vulnerabilityQamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Ele…
- CVE-2024-43278WordPress Meta Field Block plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerabilityPhi Phan Meta Field Block
- CVE-2024-43284WordPress WP Travel Gutenberg Blocks plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityWP Travel Gutenberg Blocks
- CVE-2024-43291WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityvoidCoders Void Contact Form 7 Widget For Elementor Page Bu…
- CVE-2024-43292WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.16 - Cross Site Scripting (XSS) vulnerabilityEnvoThemes Envo's Elementor Templates & Widgets for WooComm…
- CVE-2024-43294WordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityBoldThemes Bold Timeline Lite
- CVE-2024-7911SourceCodester Simple Online Bidding System index.php file inclusionSourceCodester Simple Online Bidding System
- CVE-2024-6221Improper Access Control in corydolphin/flask-corscorydolphin/flask-cors · flask-cors
- CVE-2024-7910CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted uploadCodeAstro Online Railway Reservation System
- CVE-2024-7907TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injectionTOTOLINK X6000R
- CVE-2024-43305WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerabilityCode Amp Custom Layouts – Post + Product grids made easy
- CVE-2024-43307WordPress Structured Content (JSON-LD) #wpsc plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerabilityGordon Böhme, Antonio Leutsch Structured Content
- CVE-2024-43308WordPress Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerabilityGutentor - Gutenberg Blocks - Page Builder for Gutenberg Ed…
- CVE-2024-43309WordPress WP Telegram Widget and Join Link plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerabilityWP Socio WP Telegram Widget and Join Link
- CVE-2024-43318WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerabilitye2pdf
- CVE-2024-43320WordPress WPBakery Page Builder Addons plugin <= 3.9 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for WPBakery Page Builder
- CVE-2024-43321WordPress Team Showcase plugin <= 1.22.23 - Cross Site Scripting (XSS) vulnerabilityPickPlugins Team Showcase
- CVE-2024-43324WordPress Clever Addons for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityCleverSoft Clever Addons for Elementor
- CVE-2024-43329WordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityWP Chill Allegiant
- CVE-2024-43335WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerabilityCyberChimps Responsive Blocks – WordPress Gutenberg Blocks
- CVE-2024-39666WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerabilityAutomattic WooCommerce
- CVE-2024-7906DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted uploadDedeBIZ
- CVE-2024-43342WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityBdThemes Ultimate Store Kit Elementor Addons
- CVE-2024-43344WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerabilityIcegram
- CVE-2024-43346WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerabilityWow-Company Modal Window
- CVE-2024-43347WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerabilityVirusTran Button contact VR
- CVE-2024-43349WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerabilityall_bootstrap_blocks All Bootstrap Blocks
- CVE-2024-43351WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Bravada
- CVE-2024-43352WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerabilityOrganic Themes GivingPress Lite
- CVE-2024-43353WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal myCred
- CVE-2024-7905DedeBIZ archives_do.php AdminUpload unrestricted uploadDedeBIZ
- CVE-2024-7904DedeBIZ File Extension file_manage_control.php unrestricted uploadDedeBIZ
- CVE-2024-7903DedeBIZ File Extension media_add.php unrestricted uploadDedeBIZ