CVEs published October 5, 2024
82 CVEs were published on October 5, 2024: 1 critical, 31 high.
- Published
- 82
- Critical
- 1
- High
- 31
- Medium
- 50
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- D-Link DIR-605L
- 4
- Ex-Themes WP Timeline – Vertical and Horizontal timeline pl…
- 2
- LiteSpeed Technologies LiteSpeed Cache
- 2
- rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- 2
- The Wikimedia Foundation Mediawiki - Cargo
- 2
- The Wikimedia Foundation Mediawiki - CSS Extension
- 2
- ABCApp Creator
- 1
- Alex Include Fussball.de Widgets
- 1
- amarksteadman Podiant
- 1
- AresIT WP Compress
- 1
Critical 1
High 31
- CVE-2024-47369WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerabilitywpweb Social Auto Poster
- CVE-2024-47374WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-47378WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityLomu WPCOM Member
- CVE-2024-47379WordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityShamalli Web Directory Free
- CVE-2024-47380WordPress WP-Lister Lite for eBay plugin <= 3.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2024-47384WordPress WP Compress plugin <= 6.20.13 - Reflected Cross Site Scripting (XSS) vulnerabilityAresIT WP Compress
- CVE-2024-47386WordPress WP Extended plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityThe Ultimate WordPress Toolkit – WP Extended
- CVE-2024-47388WordPress SliceWP Affiliates plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerabilityiova.mihai SliceWP
- CVE-2024-47389WordPress NEX-Forms plugin <= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms
- CVE-2024-47394WordPress WP JobSearch plugin <= 2.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityeyecix JobSearch
- CVE-2024-47395WordPress Robokassa payment gateway for Woocommerce plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRobokassa payment gateway for Woocommerce
- CVE-2024-47624WordPress BSK Forms Blacklist plugin <= 3.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilitybannersky BSK Forms Blacklist
- CVE-2024-9535D-Link DIR-605L formEasySetupWWConfig buffer overflowD-Link DIR-605L
- CVE-2024-9534D-Link DIR-605L formEasySetPassword buffer overflowD-Link DIR-605L
- CVE-2024-47638WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-9533D-Link DIR-605L formDeviceReboot buffer overflowD-Link DIR-605L
- CVE-2024-47644WordPress Copyscape Premium plugin <= 1.3.9 - CSRF to Stored Cross-Site Scripting vulnerabilityCopyscape Premium
- CVE-2024-47324WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerabilityEx-Themes WP Timeline – Vertical and Horizontal timeline pl…
- CVE-2024-47323WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerabilityEx-Themes WP Timeline – Vertical and Horizontal timeline pl…
- CVE-2024-47319WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerabilityBit Apps Bit Form
- CVE-2024-44034WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerabilityMartin Greenwood WPSPX
- CVE-2024-44023WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerabilityABCApp Creator
- CVE-2024-44018WordPress Instant Chat WP plugin <= 1.0.5 - Local File Inclusion vulnerabilityistmoplugins Instant Chat Floating Button for WordPress Web…
- CVE-2024-9314Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injectionrankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-44016WordPress Podiant plugin <= 1.1 - Local File Inclusion vulnerabilityamarksteadman Podiant
- CVE-2024-44015WordPress Users Control plugin <= 1.0.16 - Local File Inclusion vulnerabilityistmoplugins Users Control
- CVE-2024-44013WordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerabilityInnate Images VR Calendar
- CVE-2024-44012WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerabilitywpdev33 WP Newsletter Subscription
- CVE-2024-44011WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerabilityExpressTech Systems WP Ticket Ultra Help Desk & Support Plu…
- CVE-2024-9532D-Link DIR-605L formAdvanceSetup buffer overflowD-Link DIR-605L
- CVE-2024-47849Backticks can allow the usage of not-allowed SQL functionsThe Wikimedia Foundation Mediawiki - Cargo
Medium, low and unrated 50
- CVE-2024-9536ESAFENET CDG MultiServerBackService sql injectionESAFENET CDG
- CVE-2024-47370WordPress Author Avatars List/Block plugin <= 2.1.21 - Cross Site Scripting (XSS) vulnerabilityPaul Bearne Author Avatars List/Block
- CVE-2024-47371WordPress WP MyLinks plugin<= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityWalter Pinem WP MyLinks
- CVE-2024-47372WordPress TNC PDF viewer plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityThemeNcode TNC PDF viewer
- CVE-2024-47373WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-47375WordPress XLTab – Accordions and Tabs for Elementor Page Builder plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitywebangon XLTab – Accordions and Tabs for Elementor Page Bui…
- CVE-2024-47376WordPress Slideshow Gallery LITE plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityTribulant Software Slideshow Gallery
- CVE-2024-47377WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerabilityThemekraft BuddyForms
- CVE-2024-47381WordPress Slider & Popup Builder by Depicter plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityaverta Depicter Slider
- CVE-2024-47382WordPress Page-list plugin <= 5.6 - Cross Site Scripting (XSS) vulnerabilitywebvitaly Page-list
- CVE-2024-47383WordPress The Pack Elementor addons plugin 2.0.8.8 - Cross Site Scripting (XSS) vulnerabilitywebangon The Pack Elementor addons
- CVE-2024-47385WordPress Essential Blocks plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2024-47387WordPress Search Atlas SEO plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilitySearch Atlas Group Search Atlas SEO
- CVE-2024-47390WordPress Jeg Elementor Kit plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerabilityjegtheme Jeg Elementor Kit
- CVE-2024-47391WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
- CVE-2024-47392WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerabilitybdthemes Element Pack Elementor Addons
- CVE-2024-47393WordPress Quill Forms plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerabilityMohamed Magdy Quill Forms
- CVE-2024-47621WordPress Zotpress plugin <= 7.3.10 - Cross Site Scripting (XSS) vulnerabilityKatie Zotpress
- CVE-2024-47622WordPress Advanced Woo Labels plugin <= 2.01 - Cross Site Scripting (XSS) vulnerabilityILLID Advanced Woo Labels
- CVE-2024-47623WordPress Gallery Lightbox plugin <= 1.0.0.39 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Gallery Lightbox
- CVE-2024-47625WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilitythemelooks Enter Addons
- CVE-2024-47626WordPress RomethemeKit For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityRometheme RTMKit
- CVE-2024-47627WordPress WP Travel Gutenberg Blocks plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityWP Travel Gutenberg Blocks
- CVE-2024-47628WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.3 - Cross Site Scripting (XSS) vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2024-47629WordPress Ultimate Store Kit Elementor Addons plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2024-47630WordPress ElementInvader Addons for Elementor plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2024-47631WordPress Logo Carousel – Clients logo carousel for WP plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitybPlugins Logo Carousel – Clients logo carousel for WP
- CVE-2024-47632WordPress DethemeKit For Elementor plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerabilityDethemeKit For Elementor
- CVE-2024-47633WordPress Zoho forms plugin <= 4.0 - Cross Site Scripting (XSS) vulnerabilityZoho Forms
- CVE-2024-47635WordPress TinyPNG plugin <= 3.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityTinyPNG
- CVE-2024-47639WordPress VdoCipher plugin <= 1.29 - Cross Site Scripting (XSS) vulnerabilityVibhav Sinha VdoCipher
- CVE-2024-47642WordPress Keap Official Opt-in Forms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityKeap Official Opt-in Forms
- CVE-2024-47643WordPress Include Fussball.de Widgets plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerabilityAlex Include Fussball.de Widgets
- CVE-2024-47646WordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerabilitytomlister Payflex Payment Gateway
- CVE-2024-47647WordPress FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin plugin <= 1.27 - Cross Site Scripting (XSS) vulnerabilityEssekia Helpie FAQ
- CVE-2024-47316WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerabilityDimitri Grassi Salon booking system
- CVE-2024-47309WordPress Cities Shipping Zones for WooCommerce plugin <= 1.2.7 - Local File Inclusion vulnerabilityCondless Cities Shipping Zones for WooCommerce
- CVE-2024-9161Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Deleterankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…
- CVE-2024-9146WordPress CSS JS Files plugin <= 1.5.0 - Directory Traversal to File Read vulnerabilityjamesdlow CSS JS Files
- CVE-2024-9417Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Uploadhashthemes Hash Form – Drag & Drop Form Builder
- CVE-2024-8486Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgetsaverta Shortcodes and extra features for Phlox theme
- CVE-2024-8743Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Uploadbitpressadmin File Manager
- CVE-2024-9528Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scriptingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-9385Themify Builder <= 7.6.2 - Reflected Cross-Site Scriptingthemifyme Themify Builder
- CVE-2024-9455WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadguillaume-lostweb WP Cleanup and Basic Functions
- CVE-2024-47841Path traversal when loading stylesheetsThe Wikimedia Foundation Mediawiki - CSS Extension
- CVE-2024-47840Stored XSS through sidebar in Apex skinThe Wikimedia Foundation Mediawiki - Apex skin
- CVE-2024-47847Various XSSes found in CargoThe Wikimedia Foundation Mediawiki - Cargo · mediawiki/cargo
- CVE-2024-47846Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protectionThe Wikimedia Foundation Mediawiki - Cargo
- CVE-2024-47845CSS sanitizer used incorrectly, and is easily bypassedThe Wikimedia Foundation Mediawiki - CSS Extension