# CVEs published 2024-08-18

66 CVEs were published on August 18, 2024: 0 critical, 20 high. Days are UTC.

- [CVE-2024-7917](https://cve.now/CVE-2024-7917.md): DouPHP Favicon system.php unrestricted upload (CVSS 5.1, DouPHP)
- [CVE-2024-7916](https://cve.now/CVE-2024-7916.md): nafisulbari/itsourcecode Insurance Management System Add Nominee Page addNominee.php cross site scripting (CVSS 5.3, nafisulbari Insurance Management System · itsourcecode Insu…)
- [CVE-2024-7914](https://cve.now/CVE-2024-7914.md): SourceCodester Yoga Class Registration System SystemSettings.php cross site scripting (CVSS 5.3, SourceCodester Yoga Class Registration System)
- [CVE-2024-7913](https://cve.now/CVE-2024-7913.md): itsourcecode Billing System addclient1.php sql injection (CVSS 6.9, itsourcecode Billing System)
- [CVE-2024-35686](https://cve.now/CVE-2024-35686.md): WordPress Sensei LMS plugin \<= 4.23.1 - Broken Access Control vulnerability (CVSS 5.3, Automattic Sensei LMS · Automattic Sensei Pro)
- [CVE-2024-43145](https://cve.now/CVE-2024-43145.md): WordPress GeoDirectory plugin \<= 2.3.61 - SQL Injection vulnerability (CVSS 8.5, AyeCode GeoDirectory)
- [CVE-2024-43207](https://cve.now/CVE-2024-43207.md): WordPress Unite Gallery Lite plugin \<= 1.7.62 - SQL Injection vulnerability (CVSS 8.5, Valiano Unite Gallery Lite)
- [CVE-2024-43282](https://cve.now/CVE-2024-43282.md): WordPress Tutor LMS plugin \<= 2.7.2 - SQL Injection vulnerability (CVSS 7.6, Themeum Tutor LMS)
- [CVE-2024-43286](https://cve.now/CVE-2024-43286.md): WordPress Squirrly SEO plugin \<= 12.3.19 - SQL Injection vulnerability (CVSS 8.5, SEO Plugin by Squirrly SEO)
- [CVE-2024-43239](https://cve.now/CVE-2024-43239.md): WordPress Masteriyo LMS plugin \<= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability (CVSS 4.3, Masteriyo - LMS)
- [CVE-2024-43266](https://cve.now/CVE-2024-43266.md): WordPress WP Job Portal plugin \<= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, wpjobportal WP Job Portal)
- [CVE-2024-43288](https://cve.now/CVE-2024-43288.md): WordPress wpForo Forum plugin \<= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, gVectors Team wpForo Forum)
- [CVE-2024-43315](https://cve.now/CVE-2024-43315.md): WordPress Stripe Payments For WooCommerce plugin \<= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Checkout Plugins Stripe Payments For WooCommerce by Checkout)
- [CVE-2024-43322](https://cve.now/CVE-2024-43322.md): WordPress Zephyr Project Manager plugin \<= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.4, Dylan James Zephyr Project Manager)
- [CVE-2024-7912](https://cve.now/CVE-2024-7912.md): CodeAstro Online Railway Reservation System assets exposure of information through directory listing (CVSS 6.9, CodeAstro Online Railway Reservation System)
- [CVE-2024-43350](https://cve.now/CVE-2024-43350.md): WordPress Propovoice CRM plugin \<= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, Propovoice CRM)
- [CVE-2024-43241](https://cve.now/CVE-2024-43241.md): WordPress Indeed Ultimate Membership Pro plugin \<= 12.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, azzaroco Ultimate Membership Pro)
- [CVE-2024-43244](https://cve.now/CVE-2024-43244.md): WordPress houzez Theme By FaveThemes \<= 3.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, favethemes Houzez)
- [CVE-2024-43246](https://cve.now/CVE-2024-43246.md): WordPress WHMpress plugin \<= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, creativeon WHMpress)
- [CVE-2024-43262](https://cve.now/CVE-2024-43262.md): WordPress Busiprof theme \<= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webriti Busiprof)
- [CVE-2024-43263](https://cve.now/CVE-2024-43263.md): WordPress Visual Composer Starter theme \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Visual Composer Starter)
- [CVE-2024-43267](https://cve.now/CVE-2024-43267.md): WordPress Mega Addons For Elementor plugin \<= 1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Qamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Ele…)
- [CVE-2024-43278](https://cve.now/CVE-2024-43278.md): WordPress Meta Field Block plugin \<= 1.2.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Phi Phan Meta Field Block)
- [CVE-2024-43279](https://cve.now/CVE-2024-43279.md): WordPress Newsletters plugin \<= 4.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tribulant Newsletters)
- [CVE-2024-43284](https://cve.now/CVE-2024-43284.md): WordPress WP Travel Gutenberg Blocks plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Travel Gutenberg Blocks)
- [CVE-2024-43291](https://cve.now/CVE-2024-43291.md): WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin \<= 2.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, voidCoders Void Contact Form 7 Widget For Elementor Page Bu…)
- [CVE-2024-43292](https://cve.now/CVE-2024-43292.md): WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin \<= 1.4.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, EnvoThemes Envo's Elementor Templates & Widgets for WooComm…)
- [CVE-2024-43294](https://cve.now/CVE-2024-43294.md): WordPress Bold Timeline Lite plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BoldThemes Bold Timeline Lite)
- [CVE-2024-43303](https://cve.now/CVE-2024-43303.md): WordPress White Label CMS plugin \<= 2.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, videousermanuals.com White Label CMS)
- [CVE-2024-43304](https://cve.now/CVE-2024-43304.md): WordPress Cryptocurrency Widgets plugin \<= 2.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins…)
- [CVE-2024-7911](https://cve.now/CVE-2024-7911.md): SourceCodester Simple Online Bidding System index.php file inclusion (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-6221](https://cve.now/CVE-2024-6221.md): Improper Access Control in corydolphin/flask-cors (CVSS 6.5, corydolphin/flask-cors · flask-cors)
- [CVE-2024-7910](https://cve.now/CVE-2024-7910.md): CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload (CVSS 5.1, CodeAstro Online Railway Reservation System)
- [CVE-2024-7909](https://cve.now/CVE-2024-7909.md): TOTOLINK EX1200L cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 8.7, TOTOLINK EX1200L)
- [CVE-2024-7908](https://cve.now/CVE-2024-7908.md): TOTOLINK EX1200L cstecgi.cgi setDefResponse stack-based overflow (CVSS 8.7, TOTOLINK EX1200L)
- [CVE-2024-7907](https://cve.now/CVE-2024-7907.md): TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection (CVSS 5.3, TOTOLINK X6000R)
- [CVE-2024-43305](https://cve.now/CVE-2024-43305.md): WordPress Custom Layouts – Post + Product grids made easy plugin \<= 1.4.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Code Amp Custom Layouts – Post + Product grids made easy)
- [CVE-2024-43306](https://cve.now/CVE-2024-43306.md): WordPress WP-Lister Lite for eBay plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Lab WP-Lister Lite for eBay)
- [CVE-2024-43307](https://cve.now/CVE-2024-43307.md): WordPress Structured Content (JSON-LD) #wpsc plugin \<= 1.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gordon Böhme, Antonio Leutsch Structured Content)
- [CVE-2024-43308](https://cve.now/CVE-2024-43308.md): WordPress Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin \<= 3.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Ed…)
- [CVE-2024-43309](https://cve.now/CVE-2024-43309.md): WordPress WP Telegram Widget and Join Link plugin \<= 2.1.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Socio WP Telegram Widget and Join Link)
- [CVE-2024-43313](https://cve.now/CVE-2024-43313.md): WordPress FormFacade plugin \<= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, manidoraisamy FormFacade)
- [CVE-2024-43318](https://cve.now/CVE-2024-43318.md): WordPress E2Pdf – Export To Pdf Tool for WordPress plugin \<= 1.25.05 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, e2pdf)
- [CVE-2024-43320](https://cve.now/CVE-2024-43320.md): WordPress WPBakery Page Builder Addons plugin \<= 3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for WPBakery Page Builder)
- [CVE-2024-43321](https://cve.now/CVE-2024-43321.md): WordPress Team Showcase plugin \<= 1.22.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Team Showcase)
- [CVE-2024-43324](https://cve.now/CVE-2024-43324.md): WordPress Clever Addons for Elementor plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, CleverSoft Clever Addons for Elementor)
- [CVE-2024-43327](https://cve.now/CVE-2024-43327.md): WordPress Invite Anyone plugin \<= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Boone Gorges Invite Anyone)
- [CVE-2024-43329](https://cve.now/CVE-2024-43329.md): WordPress Allegiant theme \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Chill Allegiant)
- [CVE-2024-43330](https://cve.now/CVE-2024-43330.md): WordPress PowerPack for Beaver Builder plugin \< 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IdeaBox Creations PowerPack for Beaver Builder)
- [CVE-2024-43335](https://cve.now/CVE-2024-43335.md): WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin \<= 1.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CyberChimps Responsive Blocks – WordPress Gutenberg Blocks)
- [CVE-2024-43238](https://cve.now/CVE-2024-43238.md): WordPress weMail plugin \<= 1.14.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, weDevs weMail)
- [CVE-2024-39666](https://cve.now/CVE-2024-39666.md): WordPress WooCommerce plugin \<= 9.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Automattic WooCommerce)
- [CVE-2024-7906](https://cve.now/CVE-2024-7906.md): DedeBIZ Attachment Settings select\_images\_post.php get\_mime\_type unrestricted upload (CVSS 5.3, DedeBIZ)
- [CVE-2024-43276](https://cve.now/CVE-2024-43276.md): WordPress Child Theme Creator by Orbisius plugin \<= 1.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Svetoslav Marinov (Slavi) Child Theme Creator)
- [CVE-2024-43342](https://cve.now/CVE-2024-43342.md): WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Ultimate Store Kit Elementor Addons)
- [CVE-2024-43344](https://cve.now/CVE-2024-43344.md): WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin \<= 3.1.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Icegram)
- [CVE-2024-43346](https://cve.now/CVE-2024-43346.md): WordPress Modal Window – create popup modal window plugin \<= 6.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Wow-Company Modal Window)
- [CVE-2024-43347](https://cve.now/CVE-2024-43347.md): WordPress Button contact VR plugin \<= 4.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, VirusTran Button contact VR)
- [CVE-2024-43348](https://cve.now/CVE-2024-43348.md): WordPress Purity Of Soul theme \<= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Iznyn Purity Of Soul)
- [CVE-2024-43349](https://cve.now/CVE-2024-43349.md): WordPress All Bootstrap Blocks plugin \<= 1.3.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, all\_bootstrap\_blocks All Bootstrap Blocks)
- [CVE-2024-43351](https://cve.now/CVE-2024-43351.md): WordPress Bravada theme \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Bravada)
- [CVE-2024-43352](https://cve.now/CVE-2024-43352.md): WordPress GivingPress Lite theme \<= 1.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Organic Themes GivingPress Lite)
- [CVE-2024-43353](https://cve.now/CVE-2024-43353.md): WordPress myCred plugin \<= 2.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saad Iqbal myCred)
- [CVE-2024-7905](https://cve.now/CVE-2024-7905.md): DedeBIZ archives\_do.php AdminUpload unrestricted upload (CVSS 5.3, DedeBIZ)
- [CVE-2024-7904](https://cve.now/CVE-2024-7904.md): DedeBIZ File Extension file\_manage\_control.php unrestricted upload (CVSS 5.3, DedeBIZ)
- [CVE-2024-7903](https://cve.now/CVE-2024-7903.md): DedeBIZ File Extension media\_add.php unrestricted upload (CVSS 5.3, DedeBIZ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.