# CVEs published 2024-10-20

68 CVEs were published on October 20, 2024: 17 critical, 23 high. Days are UTC.

- [CVE-2024-44000](https://cve.now/CVE-2024-44000.md): WordPress LiteSpeed Cache plugin \< 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability (CVSS 9.8, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-49325](https://cve.now/CVE-2024-49325.md): WordPress Photo Gallery Builder plugin \<= 3.0 - Broken Access Control to Notice Dismissal vulnerability (CVSS 4.3, wpdiscover Photo Gallery Builder)
- [CVE-2024-47634](https://cve.now/CVE-2024-47634.md): WordPress CartBounty plugin \<= 8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Streamline CartBounty – Save and recover abandoned carts fo…)
- [CVE-2024-49250](https://cve.now/CVE-2024-49250.md): WordPress Table of Contents Plus plugin \<= 2408 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Syed Balkhi Table of Contents Plus)
- [CVE-2024-49272](https://cve.now/CVE-2024-49272.md): WordPress Social Auto Poster plugin \<= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wpweb Social Auto Poster)
- [CVE-2024-49274](https://cve.now/CVE-2024-49274.md): WordPress VOD Infomaniak plugin \<= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Infomaniak Network VOD Infomaniak)
- [CVE-2024-49275](https://cve.now/CVE-2024-49275.md): WordPress IdeaPush plugin \<= 8.69 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Northern Beaches Websites IdeaPush)
- [CVE-2024-49290](https://cve.now/CVE-2024-49290.md): WordPress Cooked Pro plugin \< 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Gora Tech Cooked Pro)
- [CVE-2024-49306](https://cve.now/CVE-2024-49306.md): WordPress WP Content Copy Protection & No Right Click plugin \<= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, wp-buy WP Content Copy Protection & No Right Click)
- [CVE-2024-49627](https://cve.now/CVE-2024-49627.md): WordPress WordPress Image SEO plugin \<= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Noor Alam WordPress Image SEO)
- [CVE-2024-49628](https://cve.now/CVE-2024-49628.md): WordPress Most And Least Read Posts Widget plugin \<= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, whiletrue Most And Least Read Posts Widget)
- [CVE-2024-49335](https://cve.now/CVE-2024-49335.md): WordPress GoogleDrive folder list plugin \<= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sh4d0w28 GoogleDrive folder list)
- [CVE-2024-49605](https://cve.now/CVE-2024-49605.md): WordPress Community Lite Video Chat plugin \<= 2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Stefan Nour AVChat Video Chat)
- [CVE-2024-49629](https://cve.now/CVE-2024-49629.md): WordPress Endless Posts Navigation plugin \<= 2.2.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Fahad Mahmood Endless Posts Navigation)
- [CVE-2024-47325](https://cve.now/CVE-2024-47325.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.7 - SQL Injection vulnerability (CVSS 8.5, Themeisle MPG)
- [CVE-2024-49609](https://cve.now/CVE-2024-49609.md): WordPress Author Discussion plugin \<= 0.2.2 - SQL Injection vulnerability (CVSS 8.5, Brandon White Author Discussion)
- [CVE-2024-49612](https://cve.now/CVE-2024-49612.md): WordPress SW Contact Form plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, Sanjeev SW Contact Form)
- [CVE-2024-49613](https://cve.now/CVE-2024-49613.md): WordPress Simple Code Insert Shortcode plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, developersnote Simple Code Insert Shortcode)
- [CVE-2024-49614](https://cve.now/CVE-2024-49614.md): WordPress SermonAudio Widgets plugin \<= 1.9.3 - SQL Injection vulnerability (CVSS 8.5, SermonAudio Widgets)
- [CVE-2024-49615](https://cve.now/CVE-2024-49615.md): WordPress SafetyForms plugin \<= 1.0.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, Henrique Rodrigues SafetyForms)
- [CVE-2024-49616](https://cve.now/CVE-2024-49616.md): WordPress Rate Own Post plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, nyasro Rate Own Post)
- [CVE-2024-49617](https://cve.now/CVE-2024-49617.md): WordPress Back Link Tracker plugin \<= 1.0.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, anciwasim Back Link Tracker)
- [CVE-2024-49618](https://cve.now/CVE-2024-49618.md): WordPress MyTweetLinks plugin \<= 1.1.1 - SQL Injection vulnerability (CVSS 8.5, Jordan Lyall MyTweetLinks)
- [CVE-2024-49619](https://cve.now/CVE-2024-49619.md): WordPress Social Link Groups plugin \<= 1.1.0 - SQL Injection vulnerability (CVSS 8.5, acespritech Social Link Groups)
- [CVE-2024-49620](https://cve.now/CVE-2024-49620.md): WordPress FERMA.ru.net plugin \<= 1.3.3 - SQL Injection vulnerability (CVSS 8.5, mrcheck116 FERMA.ru.net)
- [CVE-2024-44061](https://cve.now/CVE-2024-44061.md): WordPress EU/UK VAT Manager for WooCommerce plugin \<= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory EU/UK VAT Manager for WooCommerce)
- [CVE-2024-49621](https://cve.now/CVE-2024-49621.md): WordPress APA Register Newsletter Form plugin \<= 1.0.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, aatmaadhikari APA Register Newsletter Form)
- [CVE-2024-49622](https://cve.now/CVE-2024-49622.md): WordPress Apa Banner Slider plugin \<= 1.0.0 - CSRF to SQL Injection vulnerability (CVSS 8.2, aatmaadhikari Apa Banner Slider)
- [CVE-2024-49623](https://cve.now/CVE-2024-49623.md): WordPress Duplicate Title Validate plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, hasan movahed Duplicate Title Validate)
- [CVE-2024-49608](https://cve.now/CVE-2024-49608.md): WordPress GERRYWORKS Post by Mail plugin \<= 1.0 - Privilege Escalation vulnerability (CVSS 8.8, GERRYWORKS Post by Mail)
- [CVE-2024-49324](https://cve.now/CVE-2024-49324.md): WordPress Sovratec Case Management plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, sovratecdev Sovratec Case Management)
- [CVE-2024-49326](https://cve.now/CVE-2024-49326.md): WordPress Affiliator plugin \<= 2.1.3 - Arbitrary File Upload vulnerability (CVSS 10.0, Vasileios Kerasiotis Affiliator)
- [CVE-2024-49327](https://cve.now/CVE-2024-49327.md): WordPress Woostagram Connect plugin \<= 1.0.2 - Arbitrary File Upload vulnerability (CVSS 10.0, bepitulaz Woostagram Connect)
- [CVE-2024-49329](https://cve.now/CVE-2024-49329.md): WordPress WP REST API FNS plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, vivek2tamrakar WP REST API FNS)
- [CVE-2024-49330](https://cve.now/CVE-2024-49330.md): WordPress Nice Backgrounds plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, brx8r Nice Backgrounds)
- [CVE-2024-49331](https://cve.now/CVE-2024-49331.md): WordPress Property Lot Management System plugin \<= 4.2.38 - Arbitrary File Upload vulnerability (CVSS 9.9, Myriad Solutionz Property Lot Management System)
- [CVE-2024-49607](https://cve.now/CVE-2024-49607.md): WordPress WP Dropbox Dropins plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, redhopit WP Dropbox Dropins)
- [CVE-2024-49610](https://cve.now/CVE-2024-49610.md): WordPress photokit plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, photokiteditor photokit)
- [CVE-2024-10195](https://cve.now/CVE-2024-10195.md): Tecno 4G Portable WiFi TR118 SMS Check goform\_get\_cmd\_process sql injection (CVSS 5.1, Tecno 4G Portable WiFi TR118)
- [CVE-2024-49332](https://cve.now/CVE-2024-49332.md): WordPress Giveaway Boost plugin \<= 2.1.4 - PHP Object Injection vulnerability (CVSS 9.8, giveawayboost Giveaway Boost)
- [CVE-2024-49624](https://cve.now/CVE-2024-49624.md): WordPress Advanced Advertising System plugin \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 9.8, smartdevth Advanced Advertising System)
- [CVE-2024-49625](https://cve.now/CVE-2024-49625.md): WordPress SiteBuilder Dynamic Components plugin \<= 1.0 - PHP Object Injection vulnerability (CVSS 9.8, sphoid SiteBuilder Dynamic Components)
- [CVE-2024-49626](https://cve.now/CVE-2024-49626.md): WordPress Shipyaari Shipping Management plugin \<= 1.2 - PHP Object Injection vulnerability (CVSS 9.8, Piyush Patel Shipyaari Shipping Management)
- [CVE-2024-49286](https://cve.now/CVE-2024-49286.md): WordPress SSV Events plugin \<= 3.2.7 - Local File Inclusion to RCE vulnerability (CVSS 9.6, Jeroen Berkvens SSV Events)
- [CVE-2024-10194](https://cve.now/CVE-2024-10194.md): WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto\_chidx stack-based overflow (CVSS 8.7, WAVLINK WN530H4 · WAVLINK WN530HG4 +1)
- [CVE-2024-49611](https://cve.now/CVE-2024-49611.md): WordPress Product Website Showcase plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, paxmanpwnz Product Website Showcase)
- [CVE-2024-49328](https://cve.now/CVE-2024-49328.md): WordPress WP REST API FNS Plugin plugin \<= 1.0.0 - Account Takeover vulnerability (CVSS 9.8, vivek2tamrakar WP REST API FNS)
- [CVE-2024-49604](https://cve.now/CVE-2024-49604.md): WordPress Simple User Registration plugin \<= 6.7 - Broken Authentication vulnerability (CVSS 9.8, N-Media Simple User Registration)
- [CVE-2024-48049](https://cve.now/CVE-2024-48049.md): WordPress Mighty Builder plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mighty Plugins Mighty Builder)
- [CVE-2024-49323](https://cve.now/CVE-2024-49323.md): WordPress All in One Slider plugin \<= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Shahriar Alam All in One Slider)
- [CVE-2024-49334](https://cve.now/CVE-2024-49334.md): WordPress jLayer Parallax Slider plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Unizoe Web Solutions jLayer Parallax Slider)
- [CVE-2024-49606](https://cve.now/CVE-2024-49606.md): WordPress Google Map Locations plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, DotsquaresLtd Google Map Locations)
- [CVE-2024-49630](https://cve.now/CVE-2024-49630.md): WordPress WP Education for Elementor plugin \<= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DevItems WP Education)
- [CVE-2024-49631](https://cve.now/CVE-2024-49631.md): WordPress Easy Addons for Elementor plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Md Abdul Kader Easy Addons for Elementor)
- [CVE-2024-10193](https://cve.now/CVE-2024-10193.md): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping\_ddns command injection (CVSS 5.1, WAVLINK WN530H4 · WAVLINK WN530HG4 +1)
- [CVE-2024-10192](https://cve.now/CVE-2024-10192.md): PHPGurukul IFSC Code Finder Project search.php cross site scripting (CVSS 5.3, PHPGurukul IFSC Code Finder Project)
- [CVE-2024-10191](https://cve.now/CVE-2024-10191.md): PHPGurukul Boat Booking System Booking Details Page book-details.php cross site scripting (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2024-10173](https://cve.now/CVE-2024-10173.md): didi DDMQ Console Module improper authentication (CVSS 6.9, didi DDMQ)
- [CVE-2024-10171](https://cve.now/CVE-2024-10171.md): code-projects Blood Bank System massage.php sql injection (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2024-10170](https://cve.now/CVE-2024-10170.md): code-projects Hospital Management System get\_doctor.php sql injection (CVSS 5.3, code-projects Hospital Management System)
- [CVE-2024-10169](https://cve.now/CVE-2024-10169.md): code-projects Hospital Management System change-password.php sql injection (CVSS 5.3, code-projects Hospital Management System)
- [CVE-2024-10167](https://cve.now/CVE-2024-10167.md): Codezips Sales Management System deletecustind.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10166](https://cve.now/CVE-2024-10166.md): Codezips Sales Management System checkuser.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10165](https://cve.now/CVE-2024-10165.md): Codezips Sales Management System deletecustcom.php sql injection (CVSS 6.9, Codezips Sales Management System)
- [CVE-2024-10163](https://cve.now/CVE-2024-10163.md): SourceCodester Sentiment Based Movie Rating System movie\_details.php sql injection (CVSS 5.3, SourceCodester Sentiment Based Movie Rating System)
- [CVE-2024-10162](https://cve.now/CVE-2024-10162.md): PHPGurukul Boat Booking System Edit Subdomain Details Page edit-subadmin.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2024-10161](https://cve.now/CVE-2024-10161.md): PHPGurukul Boat Booking System Update Boat Image Page change-image.php unrestricted upload (CVSS 5.3, PHPGurukul Boat Booking System)
- [CVE-2024-10160](https://cve.now/CVE-2024-10160.md): PHPGurukul Boat Booking System BW Dates Report Page bwdates-report-details.php sql injection (CVSS 5.3, PHPGurukul Boat Booking System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.