CVEs published October 12, 2024
22 CVEs were published on October 12, 2024: 1 critical, 3 high.
- Published
- 22
- Critical
- 1
- High
- 3
- Medium
- 18
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- butterflymedia ImagePress – Image Gallery
- 3
- 07FLYCMS · 07FLY-CMS +1
- 1
- adamskaat Read more By Adam
- 1
- afthemes WP Post Author – Author Box, Multiple Authors, Gue…
- 1
- azexo Mynx Page Builder
- 1
- bfintal Stackable – Page Builder Gutenberg Blocks
- 1
- code-projects Blood Bank System
- 1
- dvankooten Social Sharing
- 1
- fatcatapps Forms for Mailchimp by Optin Cat – Grow Your Mai…
- 1
- guruteam Bot for Telegram on WooCommerce
- 1
Critical 1
High 3
- CVE-2024-8757Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injectionafthemes WP Post Author – Author Box, Multiple Authors, Gue…
- CVE-2024-9821Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypassguruteam Bot for Telegram on WooCommerce
- CVE-2024-49193Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming
Medium, low and unrated 18
- CVE-2024-990307FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload07FLYCMS · 07FLY-CMS +1
- CVE-2024-9894code-projects Blood Bank System reset.php sql injectioncode-projects Blood Bank System
- CVE-2024-8902Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sectionswpvibes Addon Elements for Elementor
- CVE-2024-9595TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scriptingtobiasbg TablePress – Tables in WordPress made easy
- CVE-2024-9696Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderescuethemes Rescue Shortcodes
- CVE-2024-8760Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injectionbfintal Stackable – Page Builder Gutenberg Blocks
- CVE-2024-8915Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadpixelgrade Category Icon
- CVE-2024-9704Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedvankooten Social Sharing
- CVE-2024-9756Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Uploadsldesignpl Order Attachments for WooCommerce
- CVE-2024-96702D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parametersujin2f 2D Tag Cloud
- CVE-2024-9656Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadazexo Mynx Page Builder
- CVE-2024-9776ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsbutterflymedia ImagePress – Image Gallery
- CVE-2024-7489Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parametersfatcatapps Forms for Mailchimp by Optin Cat – Grow Your Mai…
- CVE-2024-9187Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletionadamskaat Read more By Adam
- CVE-2024-9824ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Updatebutterflymedia ImagePress – Image Gallery
- CVE-2024-9778ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Updatebutterflymedia ImagePress – Image Gallery
- CVE-2024-9860Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo ImportQODE Bridge Core
- CVE-2024-9592Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_optionsscottpaterson Easy PayPal Gift Certificate