# Vulnerabilities published in 2024 - [CVE-2024-56318](https://insights.sbomify.com/CVE-2024-56318/): Null dereference in Matter (high 7.5) - [CVE-2024-56317](https://insights.sbomify.com/CVE-2024-56317/): Denial of service in Matter (high 7.5) - [CVE-2024-56316](https://insights.sbomify.com/CVE-2024-56316/): In AXESS ACS (Auto Configuration Server) through 5.2.0, unsanitized user input in the TR069 API allows remote unauthenticated attackers to c (high 7.5) - [CVE-2024-56314](https://insights.sbomify.com/CVE-2024-56314/): Cross-site scripting in vanderbilt:redcap (medium 5.4) - [CVE-2024-56313](https://insights.sbomify.com/CVE-2024-56313/): Cross-site scripting in vanderbilt:redcap (medium 5.4) - [CVE-2024-56312](https://insights.sbomify.com/CVE-2024-56312/): Cross-site scripting in vanderbilt:redcap (medium 5.4) - [CVE-2024-56311](https://insights.sbomify.com/CVE-2024-56311/): Cross-site request forgery in vanderbilt:redcap (high 8.8) - [CVE-2024-56310](https://insights.sbomify.com/CVE-2024-56310/): Cross-site request forgery in vanderbilt:redcap (high 8.8) - [CVE-2024-5631](https://insights.sbomify.com/CVE-2024-5631/): Information disclosure in NVR3608PGE2W (medium 6.0) - [CVE-2024-56302](https://insights.sbomify.com/CVE-2024-56302/): WordPress ConvertCalculator for WordPress plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56301](https://insights.sbomify.com/CVE-2024-56301/): WordPress Distance Based Shipping Calculator Plugin <= 2.0.21 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56300](https://insights.sbomify.com/CVE-2024-56300/): WordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerability (high 7.5) - [CVE-2024-5630](https://insights.sbomify.com/CVE-2024-5630/): Insert or Embed Articulate Content into WordPress < 4.3000000024 - Author+ Arbitrary File Upload (high 8.8) - [CVE-2024-56299](https://insights.sbomify.com/CVE-2024-56299/): WordPress Notify Odoo plugin <= 1.0.0 - CSRF to Stored XSS vulnerability (high 7.1) - [CVE-2024-56298](https://insights.sbomify.com/CVE-2024-56298/): WordPress Pretty Simple Popup Builder Plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56297](https://insights.sbomify.com/CVE-2024-56297/): WordPress Highlight plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56296](https://insights.sbomify.com/CVE-2024-56296/): WordPress Mang Board WP plugin <= 1.8.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56295](https://insights.sbomify.com/CVE-2024-56295/): WordPress Poll Maker plugin <= 5.5.6 - Broken Access Control vulnerability (medium 6.5) - [CVE-2024-56294](https://insights.sbomify.com/CVE-2024-56294/): WordPress Nexter Blocks plugin <= 4.0.7 - Broken Access Control vulnerability (medium 6.4) - [CVE-2024-56293](https://insights.sbomify.com/CVE-2024-56293/): WordPress AFI – The Easiest Integration Plugin <= 1.95.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56292](https://insights.sbomify.com/CVE-2024-56292/): WordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56291](https://insights.sbomify.com/CVE-2024-56291/): WordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability (high 8.1) - [CVE-2024-56290](https://insights.sbomify.com/CVE-2024-56290/): SQL injection in Multiple Shipping And Billing Address For Woocommerce (critical 9.3) - [CVE-2024-5629](https://insights.sbomify.com/CVE-2024-5629/): Out-of-bounds read in bson module of PyMongo (medium 4.7) - [CVE-2024-56289](https://insights.sbomify.com/CVE-2024-56289/): WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56288](https://insights.sbomify.com/CVE-2024-56288/): WordPress WP Docs plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56287](https://insights.sbomify.com/CVE-2024-56287/): WordPress WP jQuery DataTable Plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56286](https://insights.sbomify.com/CVE-2024-56286/): WordPress Classic Addons – WPBakery Page Builder plugin <= 3.0 - Local File Inclusion vulnerability (high 7.5) - [CVE-2024-56285](https://insights.sbomify.com/CVE-2024-56285/): WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.5.1 - Cross-Site Scripting vulnerability (medium 6.5) - [CVE-2024-56284](https://insights.sbomify.com/CVE-2024-56284/): WordPress SSL Wireless SMS Notification Plugin <= 3.5.0 - SQL Injection vulnerability (critical 9.3) - [CVE-2024-56283](https://insights.sbomify.com/CVE-2024-56283/): WordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerability (high 8.1) - [CVE-2024-56282](https://insights.sbomify.com/CVE-2024-56282/): WordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerability (high 7.5) - [CVE-2024-56281](https://insights.sbomify.com/CVE-2024-56281/): WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin <= 5.2.0 - Local File Inclusion vulnerability (high 7.5) - [CVE-2024-56280](https://insights.sbomify.com/CVE-2024-56280/): WordPress WPGuppy plugin <= 1.1.0 - Privilege Escalation vulnerability (high 8.8) - [CVE-2024-5628](https://insights.sbomify.com/CVE-2024-5628/): Cross-site scripting in Avada (Fusion) Builder (medium 6.4) - [CVE-2024-56279](https://insights.sbomify.com/CVE-2024-56279/): WordPress Compact WP Audio Player plugin <= 1.9.14 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4) - [CVE-2024-56278](https://insights.sbomify.com/CVE-2024-56278/): WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability (critical 9.1) - [CVE-2024-56277](https://insights.sbomify.com/CVE-2024-56277/): WordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerability (medium 5.3) - [CVE-2024-56276](https://insights.sbomify.com/CVE-2024-56276/): WordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56275](https://insights.sbomify.com/CVE-2024-56275/): WordPress Envato Elements plugin <= 2.0.14 - Server Side Request Forgery (SSRF) vulnerability (medium 4.1) - [CVE-2024-56274](https://insights.sbomify.com/CVE-2024-56274/): WordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56273](https://insights.sbomify.com/CVE-2024-56273/): WordPress WPvivid Backup plugin <= 0.9.106 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56272](https://insights.sbomify.com/CVE-2024-56272/): WordPress Hide Category by User Role for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56271](https://insights.sbomify.com/CVE-2024-56271/): WordPress WP SecureSubmit plugin <= 1.5.20 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56270](https://insights.sbomify.com/CVE-2024-56270/): WordPress WP SecureSubmit plugin <= 1.5.20 - Sensitive Data Exposure vulnerability (medium 5.3) - [CVE-2024-5627](https://insights.sbomify.com/CVE-2024-5627/): WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS (medium 5.4) - [CVE-2024-56268](https://insights.sbomify.com/CVE-2024-56268/): WordPress Post Grid Elementor Addon plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56267](https://insights.sbomify.com/CVE-2024-56267/): WordPress Interactive UK Map plugin <= 3.4.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56266](https://insights.sbomify.com/CVE-2024-56266/): WordPress MP3 Audio Player plugin <= 5.8 - Broken Access Control vulnerability (medium 6.3) - [CVE-2024-56265](https://insights.sbomify.com/CVE-2024-56265/): WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56264](https://insights.sbomify.com/CVE-2024-56264/): WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability (medium 6.6) - [CVE-2024-56263](https://insights.sbomify.com/CVE-2024-56263/): WordPress GS Shots for Dribbble plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56262](https://insights.sbomify.com/CVE-2024-56262/): WordPress GS Coaches plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56261](https://insights.sbomify.com/CVE-2024-56261/): WordPress Project Showcase plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56260](https://insights.sbomify.com/CVE-2024-56260/): WordPress ShopElement plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-5626](https://insights.sbomify.com/CVE-2024-5626/): Inline Related Posts < 3.7.0 - Reflected XSS (medium 5.9) - [CVE-2024-56259](https://insights.sbomify.com/CVE-2024-56259/): WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56258](https://insights.sbomify.com/CVE-2024-56258/): WordPress Magazine Blocks plugin <= 1.3.20 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56257](https://insights.sbomify.com/CVE-2024-56257/): WordPress Coins MarketCap plugin <= 5.5.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56256](https://insights.sbomify.com/CVE-2024-56256/): WordPress Embed PDF Viewer plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56255](https://insights.sbomify.com/CVE-2024-56255/): WordPress AyeCode Connect plugin <= 1.3.8 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56254](https://insights.sbomify.com/CVE-2024-56254/): WordPress Move Addons for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56253](https://insights.sbomify.com/CVE-2024-56253/): WordPress Data Tables Generator by Supsystic plugin <= 1.10.36 - Broken Access Control vulnerability (medium 5.4) - [CVE-2024-56252](https://insights.sbomify.com/CVE-2024-56252/): WordPress Enter Addons plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56251](https://insights.sbomify.com/CVE-2024-56251/): WordPress Event Espresso plugin <= 5.0.28.decaf - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-56250](https://insights.sbomify.com/CVE-2024-56250/): WordPress Just Writing Statistics plugin <= 4.7 - SQL Injection vulnerability (high 7.6) - [CVE-2024-5625](https://insights.sbomify.com/CVE-2024-5625/): XML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console (medium 6.5) - [CVE-2024-56249](https://insights.sbomify.com/CVE-2024-56249/): WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability (critical 9.1) - [CVE-2024-56248](https://insights.sbomify.com/CVE-2024-56248/): WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Download vulnerability (medium 4.9) - [CVE-2024-56247](https://insights.sbomify.com/CVE-2024-56247/): WordPress WP Post Author plugin <= 3.8.2 - SQL Injection vulnerability (high 7.6) - [CVE-2024-56246](https://insights.sbomify.com/CVE-2024-56246/): WordPress Nexter Blocks plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56245](https://insights.sbomify.com/CVE-2024-56245/): WordPress Premium Blocks plugin <= 2.1.42 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56244](https://insights.sbomify.com/CVE-2024-56244/): WordPress Ashe Extra plugin <= 1.2.92 - Broken Access Control vulnerability (medium 5.4) - [CVE-2024-56243](https://insights.sbomify.com/CVE-2024-56243/): WordPress WPSSO Core plugin <= 18.18.1 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56242](https://insights.sbomify.com/CVE-2024-56242/): WordPress Arconix Shortcodes plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56241](https://insights.sbomify.com/CVE-2024-56241/): WordPress WPKoi Templates for Elementor plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56240](https://insights.sbomify.com/CVE-2024-56240/): WordPress Pronamic Google Maps plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-5624](https://insights.sbomify.com/CVE-2024-5624/): Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL (medium 5.1) - [CVE-2024-56239](https://insights.sbomify.com/CVE-2024-56239/): WordPress Themify Audio Dock plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56238](https://insights.sbomify.com/CVE-2024-56238/): WordPress Floating Action Buttons plugin <= 0.9.1 - Broken Access Control vulnerability (medium 5.3) - [CVE-2024-56237](https://insights.sbomify.com/CVE-2024-56237/): WordPress Contest Gallery plugin <= 24.0.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-56236](https://insights.sbomify.com/CVE-2024-56236/): WordPress Hestia Nginx Cache plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-56235](https://insights.sbomify.com/CVE-2024-56235/): WordPress Coupon plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56234](https://insights.sbomify.com/CVE-2024-56234/): WordPress VW Automobile Lite theme <= 2.1 - Broken Access Control vulnerability (medium 5.4) - [CVE-2024-56233](https://insights.sbomify.com/CVE-2024-56233/): WordPress Kintpv Wooconnect plugin <= 8.129 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56232](https://insights.sbomify.com/CVE-2024-56232/): WordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerability (high 7.1) - [CVE-2024-56231](https://insights.sbomify.com/CVE-2024-56231/): WordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56230](https://insights.sbomify.com/CVE-2024-56230/): WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability (high 7.5) - [CVE-2024-5623](https://insights.sbomify.com/CVE-2024-5623/): Untrusted search path vulnerability in B&R APROL (medium 5.4) - [CVE-2024-56229](https://insights.sbomify.com/CVE-2024-56229/): WordPress SearchIQ plugin <= 4.6 - Cross-Site Requst Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-56228](https://insights.sbomify.com/CVE-2024-56228/): Cross-site scripting in Wishlist for WooCommerce (high 7.1) - [CVE-2024-56227](https://insights.sbomify.com/CVE-2024-56227/): WordPress Royal Elementor Addons plugin <= 1.7.1001 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-56226](https://insights.sbomify.com/CVE-2024-56226/): WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56225](https://insights.sbomify.com/CVE-2024-56225/): WordPress Premium Addons for Elementor plugin <= 4.10.56 - Broken Access Control vulnerability (medium 5.4) - [CVE-2024-56224](https://insights.sbomify.com/CVE-2024-56224/): WordPress Ledenbeheer plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56223](https://insights.sbomify.com/CVE-2024-56223/): WordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2024-56222](https://insights.sbomify.com/CVE-2024-56222/): WordPress CodeBard Help Desk plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2024-56221](https://insights.sbomify.com/CVE-2024-56221/): WordPress WPMozo Addons Lite for Elementor plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-56220](https://insights.sbomify.com/CVE-2024-56220/): WordPress SSL Wireless SMS Notification plugin <= 3.6.0 - Privilege Escalation vulnerability (critical 9.8) - [CVE-2024-5622](https://insights.sbomify.com/CVE-2024-5622/): Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL (high 7.3) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/189/