# CVEs published 2024-10-06

85 CVEs were published on October 6, 2024: 4 critical, 38 high. Days are UTC.

- [CVE-2024-9563](https://cve.now/CVE-2024-9563.md): D-Link DIR-605L formWlanSetup\_Wizard buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9562](https://cve.now/CVE-2024-9562.md): D-Link DIR-605L formSetWizard2 buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9561](https://cve.now/CVE-2024-9561.md): D-Link DIR-605L formSetWAN\_Wizard52 buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9560](https://cve.now/CVE-2024-9560.md): ESAFENET CDG Catelogs;logindojojs delCatelogs sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-9559](https://cve.now/CVE-2024-9559.md): D-Link DIR-605L formWlanSetup buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9558](https://cve.now/CVE-2024-9558.md): D-Link DIR-605L formSetWanPPTP buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9557](https://cve.now/CVE-2024-9557.md): D-Link DIR-605L formSetWanPPPoE buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9556](https://cve.now/CVE-2024-9556.md): D-Link DIR-605L formSetEnableWizard buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9555](https://cve.now/CVE-2024-9555.md): D-Link DIR-605L formSetEasy\_Wizard buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47338](https://cve.now/CVE-2024-47338.md): WordPress WPExperts Square For GiveWP plugin \<= 1.3 - SQL Injection vulnerability (CVSS 8.5, Saad Iqbal WPExperts Square For GiveWP)
- [CVE-2024-47350](https://cve.now/CVE-2024-47350.md): WordPress YITH WooCommerce Ajax Search plugin \<= 2.8.0 - SQL Injection vulnerability (CVSS 9.3, YITHEMES YITH WooCommerce Ajax Search)
- [CVE-2024-47650](https://cve.now/CVE-2024-47650.md): WordPress WP-WebAuthn plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Axton WP-WebAuthn)
- [CVE-2024-44010](https://cve.now/CVE-2024-44010.md): WordPress Full frame theme \<= 2.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.1, catchthemes Full frame)
- [CVE-2024-44022](https://cve.now/CVE-2024-44022.md): WordPress Review & testimonial widgets plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Trustmary Review & testimonial widgets)
- [CVE-2024-44024](https://cve.now/CVE-2024-44024.md): WordPress Medical Addon for Elementor plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Medical Addon for Elementor)
- [CVE-2024-44025](https://cve.now/CVE-2024-44025.md): WordPress NiceJob plugin \< 3.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, NiceJob)
- [CVE-2024-44026](https://cve.now/CVE-2024-44026.md): WordPress Charity Addon for Elementor plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Charity Addon for Elementor)
- [CVE-2024-44027](https://cve.now/CVE-2024-44027.md): WordPress Gum Elementor Addon plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atawai Gum Elementor Addon)
- [CVE-2024-44028](https://cve.now/CVE-2024-44028.md): WordPress NiceJob plugin \< 3.6.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NiceJob)
- [CVE-2024-44029](https://cve.now/CVE-2024-44029.md): WordPress Viala theme \<= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Garlitz viala)
- [CVE-2024-44032](https://cve.now/CVE-2024-44032.md): WordPress Restaurant & Cafe Addon for Elementor plugin \<= 1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Restaurant & Cafe Addon for Elementor)
- [CVE-2024-45252](https://cve.now/CVE-2024-45252.md): Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 9.8, Elsight Halo)
- [CVE-2024-45251](https://cve.now/CVE-2024-45251.md): Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 9.8, Elsight Halo)
- [CVE-2024-45250](https://cve.now/CVE-2024-45250.md): ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3, ZKteco iClock v3.1-168)
- [CVE-2024-45249](https://cve.now/CVE-2024-45249.md): Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 9.8, Cavok)
- [CVE-2024-45248](https://cve.now/CVE-2024-45248.md): Multi-DNC – CWE-35: Path Traversal: '.../...//' (CVSS 7.5, Multi-DNC)
- [CVE-2024-44033](https://cve.now/CVE-2024-44033.md): WordPress Primary Addon for Elementor plugin \<= 1.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nicheaddons Primary Addon for Elementor)
- [CVE-2024-44035](https://cve.now/CVE-2024-44035.md): WordPress Gum Elementor Addon plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atawai Gum Elementor Addon)
- [CVE-2024-44036](https://cve.now/CVE-2024-44036.md): WordPress Kodex Posts likes plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pierre Lebedel Kodex Posts likes)
- [CVE-2024-44037](https://cve.now/CVE-2024-44037.md): WordPress Multipurpose Ticket Booking Manager plugin \<= 4.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, magepeopleteam Multipurpose Ticket Booking Manager)
- [CVE-2024-44039](https://cve.now/CVE-2024-44039.md): WordPress WP Travel plugin \<= 9.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Travel)
- [CVE-2024-44040](https://cve.now/CVE-2024-44040.md): WordPress ShiftController Employee Shift Scheduling plugin \<= 4.9.64 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, plainware ShiftController Employee Shift Scheduling)
- [CVE-2024-44041](https://cve.now/CVE-2024-44041.md): WordPress IdeaPush plugin \<= 8.66 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Northern Beaches Websites IdeaPush)
- [CVE-2024-44042](https://cve.now/CVE-2024-44042.md): WordPress WP Datepicker plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Fahad Mahmood WP Datepicker)
- [CVE-2024-44043](https://cve.now/CVE-2024-44043.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.27 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Photo Gallery by 10Web)
- [CVE-2024-44045](https://cve.now/CVE-2024-44045.md): WordPress WP Abstracts plugin \<= 2.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kevon Adonis WP Abstracts)
- [CVE-2024-45247](https://cve.now/CVE-2024-45247.md): Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1, Sonarr)
- [CVE-2024-45246](https://cve.now/CVE-2024-45246.md): Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element (CVSS 7.3, Diebold Nixdorf Vynamic View prior to)
- [CVE-2024-44046](https://cve.now/CVE-2024-44046.md): WordPress Themify plugin \<= 1.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, themifyme Themify – WooCommerce Product Filter)
- [CVE-2024-45454](https://cve.now/CVE-2024-45454.md): WordPress Unlimited Elements for Elementor plugin \<= 1.5.121 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unlimited Elements For Elementor)
- [CVE-2024-47297](https://cve.now/CVE-2024-47297.md): WordPress Polls CP plugin \<= 1.0.74 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, codepeople CP Polls)
- [CVE-2024-47298](https://cve.now/CVE-2024-47298.md): WordPress Bold Page Builder plugin \<= 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2024-47299](https://cve.now/CVE-2024-47299.md): WordPress Website Builder by SeedProd \<= 6.17.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Coming Soon Page, Under Construction & Maintenance Mode by…)
- [CVE-2024-47300](https://cve.now/CVE-2024-47300.md): WordPress CubeWP Forms plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Imran Tauqeer CubeWP Forms)
- [CVE-2024-47301](https://cve.now/CVE-2024-47301.md): WordPress Bit Form plugin \<= 2.13.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bit Apps Bit Form)
- [CVE-2024-47306](https://cve.now/CVE-2024-47306.md): WordPress Secure Copy Content Protection and Content Locking plugin \<= 4.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Secure Copy Content Protection and Content Locking)
- [CVE-2024-47307](https://cve.now/CVE-2024-47307.md): WordPress Meta Slider and Carousel with Lightbox plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Essential Plugin Meta slider and carousel with lightbox)
- [CVE-2024-9554](https://cve.now/CVE-2024-9554.md): Sovell Smart Canteen System Password Reset suanfa.py Check\_ET\_CheckPwdz201 authorization (CVSS 6.3, Sovell Smart Canteen System)
- [CVE-2024-47310](https://cve.now/CVE-2024-47310.md): WordPress ARI Fancy Lightbox -- Popup for WordPress plugin \<= 1.3.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, arisoft ARI Fancy Lightbox)
- [CVE-2024-47313](https://cve.now/CVE-2024-47313.md): WordPress Catch Base theme \<= 3.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.1, catchthemes Catch Base)
- [CVE-2024-47320](https://cve.now/CVE-2024-47320.md): WordPress WS Form LITE plugin \<= 1.9.238 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mark Westguard WS Form LITE)
- [CVE-2024-47322](https://cve.now/CVE-2024-47322.md): WordPress WP Timeline plugin \<= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ex-Themes WP Timeline – Vertical and Horizontal timeline pl…)
- [CVE-2024-47326](https://cve.now/CVE-2024-47326.md): WordPress Share This Image plugin \<= 2.01 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ILLID Share This Image)
- [CVE-2024-47327](https://cve.now/CVE-2024-47327.md): WordPress GEO my WP plugin \<= 4.5.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Eyal Fitoussi GEO my WordPress)
- [CVE-2024-47329](https://cve.now/CVE-2024-47329.md): WordPress ElementsReady Addons for Elementor plugin \<= 6.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-47332](https://cve.now/CVE-2024-47332.md): WordPress Sky Addons for Elementor plugin \<= 2.5.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wowDevs Sky Addons for Elementor)
- [CVE-2024-47333](https://cve.now/CVE-2024-47333.md): WordPress Loops & Logic plugin \<= 4.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tangible Loops & Logic)
- [CVE-2024-47336](https://cve.now/CVE-2024-47336.md): WordPress Terms Descriptions plugin \<= 3.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vladimir Statsenko Terms descriptions)
- [CVE-2024-47339](https://cve.now/CVE-2024-47339.md): WordPress WP Mail Catcher plugin \<= 2.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, JWardee WP Mail Catcher)
- [CVE-2024-47340](https://cve.now/CVE-2024-47340.md): WordPress ComboBlocks plugin \<= 2.2.89 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Post Grid and Gutenberg Blocks)
- [CVE-2024-47341](https://cve.now/CVE-2024-47341.md): WordPress WP-DownloadManager plugin \<= 1.68.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lester Chan WP-DownloadManager)
- [CVE-2024-47342](https://cve.now/CVE-2024-47342.md): WordPress Accordion plugin \<= 2.2.99 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Accordion)
- [CVE-2024-47343](https://cve.now/CVE-2024-47343.md): WordPress Mega Elements – Addons for Elementor plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kraft Plugins Mega Elements)
- [CVE-2024-47345](https://cve.now/CVE-2024-47345.md): WordPress Starter Templates plugin \<= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Brainstorm Force Starter Templates)
- [CVE-2024-9553](https://cve.now/CVE-2024-9553.md): D-Link DIR-605L formdumpeasysetup buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47346](https://cve.now/CVE-2024-47346.md): WordPress Newsletters plugin \<= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tribulant Software Newsletters)
- [CVE-2024-47347](https://cve.now/CVE-2024-47347.md): WordPress Chartify plugin \<= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ays Pro Chartify)
- [CVE-2024-47348](https://cve.now/CVE-2024-47348.md): WordPress Visual CSS Style Editor plugin \<= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, YellowPencil Visual CSS Style Editor)
- [CVE-2024-47349](https://cve.now/CVE-2024-47349.md): WordPress WPMobile.App plugin \<= 11.50 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Amauri WPMobile.App)
- [CVE-2024-47352](https://cve.now/CVE-2024-47352.md): WordPress WP Bulk Delete plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Xylus Themes WP Bulk Delete)
- [CVE-2024-47355](https://cve.now/CVE-2024-47355.md): WordPress Cozy Blocks plugin \<= 2.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CozyThemes Cozy Blocks)
- [CVE-2024-47356](https://cve.now/CVE-2024-47356.md): WordPress Create theme \<= 2.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.1, catchthemes Create)
- [CVE-2024-9552](https://cve.now/CVE-2024-9552.md): D-Link DIR-605L formSetWanNonLogin buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-47357](https://cve.now/CVE-2024-47357.md): WordPress Happy Addons for Elementor plugin \<= 3.12.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HappyMonster Happy Addons for Elementor)
- [CVE-2024-47360](https://cve.now/CVE-2024-47360.md): WordPress BA Book Everything plugin \<= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bookingalgorithms BA Book Everything)
- [CVE-2024-47363](https://cve.now/CVE-2024-47363.md): WordPress Blockspare plugin \<= 3.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Blockspare)
- [CVE-2024-47364](https://cve.now/CVE-2024-47364.md): WordPress Move Addons for Elementor plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, moveaddons Move Addons for Elementor)
- [CVE-2024-47365](https://cve.now/CVE-2024-47365.md): WordPress Automatically Hierarchic Categories in Menu plugin \<= 2.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Atakan Au Automatically Hierarchic Categories in Menu)
- [CVE-2024-47366](https://cve.now/CVE-2024-47366.md): WordPress Elementor Addon Elements plugin \<= 1.13.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPVibes Elementor Addon Elements)
- [CVE-2024-47367](https://cve.now/CVE-2024-47367.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, YITHEMES YITH WooCommerce Product Add-Ons)
- [CVE-2024-47368](https://cve.now/CVE-2024-47368.md): WordPress Premium Blocks plugin \<= 2.1.33 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2024-9551](https://cve.now/CVE-2024-9551.md): D-Link DIR-605L formSetWanL2TP buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9550](https://cve.now/CVE-2024-9550.md): D-Link DIR-605L formLogDnsquery buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-45245](https://cve.now/CVE-2024-45245.md): Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.8, Diebold Nixdorf Vynamic View prior)
- [CVE-2024-9549](https://cve.now/CVE-2024-9549.md): D-Link DIR-605L formEasySetupWizard formEasySetupWizard2 buffer overflow (CVSS 8.7, D-Link DIR-605L)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.