# CVEs published 2024-10-05

82 CVEs were published on October 5, 2024: 1 critical, 31 high. Days are UTC.

- [CVE-2024-9536](https://cve.now/CVE-2024-9536.md): ESAFENET CDG MultiServerBackService sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-47369](https://cve.now/CVE-2024-47369.md): WordPress Social Auto Poster plugin \<= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpweb Social Auto Poster)
- [CVE-2024-47370](https://cve.now/CVE-2024-47370.md): WordPress Author Avatars List/Block plugin \<= 2.1.21 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Paul Bearne Author Avatars List/Block)
- [CVE-2024-47371](https://cve.now/CVE-2024-47371.md): WordPress WP MyLinks plugin\<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Walter Pinem WP MyLinks)
- [CVE-2024-47372](https://cve.now/CVE-2024-47372.md): WordPress TNC PDF viewer plugin \<= 3.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThemeNcode TNC PDF viewer)
- [CVE-2024-47373](https://cve.now/CVE-2024-47373.md): WordPress LiteSpeed Cache plugin \<= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-47374](https://cve.now/CVE-2024-47374.md): WordPress LiteSpeed Cache plugin \<= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-47375](https://cve.now/CVE-2024-47375.md): WordPress XLTab – Accordions and Tabs for Elementor Page Builder plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webangon XLTab – Accordions and Tabs for Elementor Page Bui…)
- [CVE-2024-47376](https://cve.now/CVE-2024-47376.md): WordPress Slideshow Gallery LITE plugin \<= 1.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Tribulant Software Slideshow Gallery)
- [CVE-2024-47377](https://cve.now/CVE-2024-47377.md): WordPress BuddyForms plugin \<= 2.8.12 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themekraft BuddyForms)
- [CVE-2024-47378](https://cve.now/CVE-2024-47378.md): WordPress WPCOM Member plugin \<= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lomu WPCOM Member)
- [CVE-2024-47379](https://cve.now/CVE-2024-47379.md): WordPress Web Directory Free plugin \<= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shamalli Web Directory Free)
- [CVE-2024-47380](https://cve.now/CVE-2024-47380.md): WordPress WP-Lister Lite for eBay plugin \<= 3.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Lab WP-Lister Lite for eBay)
- [CVE-2024-47381](https://cve.now/CVE-2024-47381.md): WordPress Slider & Popup Builder by Depicter plugin \<= 3.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, averta Depicter Slider)
- [CVE-2024-47382](https://cve.now/CVE-2024-47382.md): WordPress Page-list plugin \<= 5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webvitaly Page-list)
- [CVE-2024-47383](https://cve.now/CVE-2024-47383.md): WordPress The Pack Elementor addons plugin 2.0.8.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, webangon The Pack Elementor addons)
- [CVE-2024-47384](https://cve.now/CVE-2024-47384.md): WordPress WP Compress plugin \<= 6.20.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AresIT WP Compress)
- [CVE-2024-47385](https://cve.now/CVE-2024-47385.md): WordPress Essential Blocks plugin \<= 4.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Blocks for Gutenberg)
- [CVE-2024-47386](https://cve.now/CVE-2024-47386.md): WordPress WP Extended plugin \<= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-47387](https://cve.now/CVE-2024-47387.md): WordPress Search Atlas SEO plugin \<= 1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Search Atlas Group Search Atlas SEO)
- [CVE-2024-47388](https://cve.now/CVE-2024-47388.md): WordPress SliceWP Affiliates plugin \<= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, iova.mihai SliceWP)
- [CVE-2024-47389](https://cve.now/CVE-2024-47389.md): WordPress NEX-Forms plugin \<= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Basix NEX-Forms)
- [CVE-2024-47390](https://cve.now/CVE-2024-47390.md): WordPress Jeg Elementor Kit plugin \<= 2.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, jegtheme Jeg Elementor Kit)
- [CVE-2024-47391](https://cve.now/CVE-2024-47391.md): WordPress Bold Page Builder plugin \< 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2024-47392](https://cve.now/CVE-2024-47392.md): WordPress Element Pack Elementor Addons plugin \<= 5.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes Element Pack Elementor Addons)
- [CVE-2024-47393](https://cve.now/CVE-2024-47393.md): WordPress Quill Forms plugin \<= 3.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mohamed Magdy Quill Forms)
- [CVE-2024-47394](https://cve.now/CVE-2024-47394.md): WordPress WP JobSearch plugin \<= 2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, eyecix JobSearch)
- [CVE-2024-47395](https://cve.now/CVE-2024-47395.md): WordPress Robokassa payment gateway for Woocommerce plugin \<= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Robokassa payment gateway for Woocommerce)
- [CVE-2024-47621](https://cve.now/CVE-2024-47621.md): WordPress Zotpress plugin \<= 7.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Katie Zotpress)
- [CVE-2024-47622](https://cve.now/CVE-2024-47622.md): WordPress Advanced Woo Labels plugin \<= 2.01 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ILLID Advanced Woo Labels)
- [CVE-2024-47623](https://cve.now/CVE-2024-47623.md): WordPress Gallery Lightbox plugin \<= 1.0.0.39 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, GhozyLab Gallery Lightbox)
- [CVE-2024-47624](https://cve.now/CVE-2024-47624.md): WordPress BSK Forms Blacklist plugin \<= 3.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bannersky BSK Forms Blacklist)
- [CVE-2024-9535](https://cve.now/CVE-2024-9535.md): D-Link DIR-605L formEasySetupWWConfig buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47625](https://cve.now/CVE-2024-47625.md): WordPress Enter Addons – Ultimate Template Builder for Elementor plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themelooks Enter Addons)
- [CVE-2024-47626](https://cve.now/CVE-2024-47626.md): WordPress RomethemeKit For Elementor plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rometheme RTMKit)
- [CVE-2024-9534](https://cve.now/CVE-2024-9534.md): D-Link DIR-605L formEasySetPassword buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47627](https://cve.now/CVE-2024-47627.md): WordPress WP Travel Gutenberg Blocks plugin \<= 3.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Travel Gutenberg Blocks)
- [CVE-2024-47628](https://cve.now/CVE-2024-47628.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.3.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LA-Studio Element Kit for Elementor)
- [CVE-2024-47629](https://cve.now/CVE-2024-47629.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bdthemes Ultimate Store Kit Elementor Addons)
- [CVE-2024-47630](https://cve.now/CVE-2024-47630.md): WordPress ElementInvader Addons for Elementor plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2024-47631](https://cve.now/CVE-2024-47631.md): WordPress Logo Carousel – Clients logo carousel for WP plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Logo Carousel – Clients logo carousel for WP)
- [CVE-2024-47632](https://cve.now/CVE-2024-47632.md): WordPress DethemeKit For Elementor plugin \<= 2.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DethemeKit For Elementor)
- [CVE-2024-47633](https://cve.now/CVE-2024-47633.md): WordPress Zoho forms plugin \<= 4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zoho Forms)
- [CVE-2024-47635](https://cve.now/CVE-2024-47635.md): WordPress TinyPNG plugin \<= 3.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, TinyPNG)
- [CVE-2024-47638](https://cve.now/CVE-2024-47638.md): WordPress Online Booking & Scheduling Calendar for WordPress plugin \<= 4.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-47639](https://cve.now/CVE-2024-47639.md): WordPress VdoCipher plugin \<= 1.29 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vibhav Sinha VdoCipher)
- [CVE-2024-9533](https://cve.now/CVE-2024-9533.md): D-Link DIR-605L formDeviceReboot buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47642](https://cve.now/CVE-2024-47642.md): WordPress Keap Official Opt-in Forms plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Keap Official Opt-in Forms)
- [CVE-2024-47643](https://cve.now/CVE-2024-47643.md): WordPress Include Fussball.de Widgets plugin \<= 4.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Alex Include Fussball.de Widgets)
- [CVE-2024-47644](https://cve.now/CVE-2024-47644.md): WordPress Copyscape Premium plugin \<= 1.3.9 - CSRF to Stored Cross-Site Scripting vulnerability (CVSS 7.1, Copyscape Premium)
- [CVE-2024-47646](https://cve.now/CVE-2024-47646.md): WordPress Payflex Payment Gateway plugin \<= 2.6.1 - Open Redirection vulnerability (CVSS 4.7, tomlister Payflex Payment Gateway)
- [CVE-2024-47647](https://cve.now/CVE-2024-47647.md): WordPress FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin plugin \<= 1.27 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Essekia Helpie FAQ)
- [CVE-2024-47324](https://cve.now/CVE-2024-47324.md): WordPress WP Timeline plugin \<= 3.6.7 - Local File Inclusion vulnerability (CVSS 7.5, Ex-Themes WP Timeline – Vertical and Horizontal timeline pl…)
- [CVE-2024-47323](https://cve.now/CVE-2024-47323.md): WordPress WP Timeline plugin \<= 3.6.7 - Local File Inclusion vulnerability (CVSS 8.1, Ex-Themes WP Timeline – Vertical and Horizontal timeline pl…)
- [CVE-2024-47319](https://cve.now/CVE-2024-47319.md): WordPress Bit Form plugin \<= 2.13.10 - Arbitrary File Upload vulnerability (CVSS 8.0, Bit Apps Bit Form)
- [CVE-2024-47316](https://cve.now/CVE-2024-47316.md): WordPress Salon Booking Wordpress Plugin plugin \<= 10.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Dimitri Grassi Salon booking system)
- [CVE-2024-47309](https://cve.now/CVE-2024-47309.md): WordPress Cities Shipping Zones for WooCommerce plugin \<= 1.2.7 - Local File Inclusion vulnerability (CVSS 6.6, Condless Cities Shipping Zones for WooCommerce)
- [CVE-2024-44034](https://cve.now/CVE-2024-44034.md): WordPress WPSPX plugin \<= 1.0.2 - Local File Inclusion vulnerability (CVSS 7.5, Martin Greenwood WPSPX)
- [CVE-2024-44023](https://cve.now/CVE-2024-44023.md): WordPress ABCApp Creator plugin \<= 1.1.2 - Local File Inclusion vulnerability (CVSS 8.1, ABCApp Creator)
- [CVE-2024-44018](https://cve.now/CVE-2024-44018.md): WordPress Instant Chat WP plugin \<= 1.0.5 - Local File Inclusion vulnerability (CVSS 7.5, istmoplugins Instant Chat Floating Button for WordPress Web…)
- [CVE-2024-9314](https://cve.now/CVE-2024-9314.md): Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \<= 1.0.228 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-9161](https://cve.now/CVE-2024-9161.md): Rank Math SEO – AI SEO Tools to Dominate SEO Rankings \<= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete (CVSS 6.5, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-44016](https://cve.now/CVE-2024-44016.md): WordPress Podiant plugin \<= 1.1 - Local File Inclusion vulnerability (CVSS 7.5, amarksteadman Podiant)
- [CVE-2024-44015](https://cve.now/CVE-2024-44015.md): WordPress Users Control plugin \<= 1.0.16 - Local File Inclusion vulnerability (CVSS 7.5, istmoplugins Users Control)
- [CVE-2024-44014](https://cve.now/CVE-2024-44014.md): WordPress Vmax Project Manager plugin \<= 1.0 - Local File Inclusion to RCE vulnerability (CVSS 9.6, Vmax Studio Vmax Project Manager)
- [CVE-2024-44013](https://cve.now/CVE-2024-44013.md): WordPress VR Calendar plugin \<= 2.4.0 - Local File Inclusion vulnerability (CVSS 7.5, Innate Images VR Calendar)
- [CVE-2024-44012](https://cve.now/CVE-2024-44012.md): WordPress WP Newsletter Subscription plugin \<= 1.1 - Local File Inclusion vulnerability (CVSS 7.5, wpdev33 WP Newsletter Subscription)
- [CVE-2024-44011](https://cve.now/CVE-2024-44011.md): WordPress WP Ticket Ultra plugin \<= 1.0.5 - Local File Inclusion vulnerability (CVSS 7.5, ExpressTech Systems WP Ticket Ultra Help Desk & Support Plu…)
- [CVE-2024-9146](https://cve.now/CVE-2024-9146.md): WordPress CSS JS Files plugin \<= 1.5.0 - Directory Traversal to File Read vulnerability (CVSS 4.9, jamesdlow CSS JS Files)
- [CVE-2024-9417](https://cve.now/CVE-2024-9417.md): Hash Form - Drag & Drop Form Builder \<= 1.1.9 - Unauthenticated Limited File Upload (CVSS 6.1, hashthemes Hash Form – Drag & Drop Form Builder)
- [CVE-2024-9532](https://cve.now/CVE-2024-9532.md): D-Link DIR-605L formAdvanceSetup buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-8486](https://cve.now/CVE-2024-8486.md): Shortcodes and extra features for Phlox theme \<= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets (CVSS 6.4, averta Shortcodes and extra features for Phlox theme)
- [CVE-2024-8743](https://cve.now/CVE-2024-8743.md): Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress \<= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload (CVSS 6.8, bitpressadmin File Manager)
- [CVE-2024-9528](https://cve.now/CVE-2024-9528.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting (CVSS 4.9, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-9385](https://cve.now/CVE-2024-9385.md): Themify Builder \<= 7.6.2 - Reflected Cross-Site Scripting (CVSS 6.1, themifyme Themify Builder)
- [CVE-2024-9455](https://cve.now/CVE-2024-9455.md): WP Cleanup and Basic Functions \<= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, guillaume-lostweb WP Cleanup and Basic Functions)
- [CVE-2024-47841](https://cve.now/CVE-2024-47841.md): Path traversal when loading stylesheets (CVSS 6.9, The Wikimedia Foundation Mediawiki - CSS Extension)
- [CVE-2024-47840](https://cve.now/CVE-2024-47840.md): Stored XSS through sidebar in Apex skin (CVSS 6.9, The Wikimedia Foundation Mediawiki - Apex skin)
- [CVE-2024-47847](https://cve.now/CVE-2024-47847.md): Various XSSes found in Cargo (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo · mediawiki/cargo)
- [CVE-2024-47846](https://cve.now/CVE-2024-47846.md): Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection (CVSS 6.9, The Wikimedia Foundation Mediawiki - Cargo)
- [CVE-2024-47849](https://cve.now/CVE-2024-47849.md): Backticks can allow the usage of not-allowed SQL functions (CVSS 8.8, The Wikimedia Foundation Mediawiki - Cargo)
- [CVE-2024-47845](https://cve.now/CVE-2024-47845.md): CSS sanitizer used incorrectly, and is easily bypassed (CVSS 6.9, The Wikimedia Foundation Mediawiki - CSS Extension)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.