# CVEs published 2024-10-12

22 CVEs were published on October 12, 2024: 1 critical, 3 high. Days are UTC.

- [CVE-2024-9903](https://cve.now/CVE-2024-9903.md): 07FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload (CVSS 5.1, 07FLYCMS · 07FLY-CMS +1)
- [CVE-2024-9894](https://cve.now/CVE-2024-9894.md): code-projects Blood Bank System reset.php sql injection (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-8757](https://cve.now/CVE-2024-8757.md): Boost Your Blog's Engagement with WP Post Author \<= 3.8.1 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, afthemes WP Post Author – Author Box, Multiple Authors, Gue…)
- [CVE-2024-8902](https://cve.now/CVE-2024-8902.md): Elementor Addon Elements \<= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table\_saved\_sections (CVSS 4.3, wpvibes Addon Elements for Elementor)
- [CVE-2024-9595](https://cve.now/CVE-2024-9595.md): TablePress \<= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, tobiasbg TablePress – Tables in WordPress made easy)
- [CVE-2024-9696](https://cve.now/CVE-2024-9696.md): Rescue Shortcodes \<= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, rescuethemes Rescue Shortcodes)
- [CVE-2024-8760](https://cve.now/CVE-2024-8760.md): Stackable – Page Builder Gutenberg Blocks \<= 3.13.6 - Unauthenticated CSS Injection (CVSS 5.3, bfintal Stackable – Page Builder Gutenberg Blocks)
- [CVE-2024-8915](https://cve.now/CVE-2024-8915.md): Category Icon \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, pixelgrade Category Icon)
- [CVE-2024-9704](https://cve.now/CVE-2024-9704.md): Social Sharing (by Danny) \<= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, dvankooten Social Sharing)
- [CVE-2024-9047](https://cve.now/CVE-2024-9047.md): WordPress File Upload \<= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu\_file\_downloader.php (CVSS 9.8, nickboss Iptanus File Upload)
- [CVE-2024-9756](https://cve.now/CVE-2024-9756.md): Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload (CVSS 4.3, sldesignpl Order Attachments for WooCommerce)
- [CVE-2024-9670](https://cve.now/CVE-2024-9670.md): 2D Tag Cloud \<= 6.0.2 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, sujin2f 2D Tag Cloud)
- [CVE-2024-9656](https://cve.now/CVE-2024-9656.md): Mynx Page Builder \<= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, azexo Mynx Page Builder)
- [CVE-2024-9776](https://cve.now/CVE-2024-9776.md): ImagePress - Image Gallery \<= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, butterflymedia ImagePress – Image Gallery)
- [CVE-2024-7489](https://cve.now/CVE-2024-7489.md): Forms for Mailchimp by Optin Cat \<= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters (CVSS 4.4, fatcatapps Forms for Mailchimp by Optin Cat – Grow Your Mai…)
- [CVE-2024-9187](https://cve.now/CVE-2024-9187.md): Read more By Adam \<= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion (CVSS 4.3, adamskaat Read more By Adam)
- [CVE-2024-9824](https://cve.now/CVE-2024-9824.md): ImagePress - Image Gallery \<= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update (CVSS 4.3, butterflymedia ImagePress – Image Gallery)
- [CVE-2024-9778](https://cve.now/CVE-2024-9778.md): ImagePress – Image Gallery \<= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, butterflymedia ImagePress – Image Gallery)
- [CVE-2024-9821](https://cve.now/CVE-2024-9821.md): Bot for Telegram on WooCommerce \<= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass (CVSS 8.8, guruteam Bot for Telegram on WooCommerce)
- [CVE-2024-9860](https://cve.now/CVE-2024-9860.md): Bridge Core \<= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import (CVSS 5.4, QODE Bridge Core)
- [CVE-2024-9592](https://cve.now/CVE-2024-9592.md): Easy PayPal Gift Certificate \<= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc\_plugin\_options (CVSS 6.1, scottpaterson Easy PayPal Gift Certificate)
- [CVE-2024-49193](https://cve.now/CVE-2024-49193.md): Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.