# Vulnerabilities published in 2024


- [CVE-2024-56064](https://insights.sbomify.com/CVE-2024-56064/): WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-56063](https://insights.sbomify.com/CVE-2024-56063/): WordPress Essential Addons for Elementor plugin <= 6.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56062](https://insights.sbomify.com/CVE-2024-56062/): WordPress Royal Elementor Addons and Templates plugin <= 1.3.987 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56061](https://insights.sbomify.com/CVE-2024-56061/): WordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerability (high 8.8)
- [CVE-2024-56060](https://insights.sbomify.com/CVE-2024-56060/): WordPress HTML Forms plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5606](https://insights.sbomify.com/CVE-2024-5606/): Quiz And Survey Master < 9.0.2 - Contributor+ SQLi (high 8.8)
- [CVE-2024-56059](https://insights.sbomify.com/CVE-2024-56059/): WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-56058](https://insights.sbomify.com/CVE-2024-56058/): WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-56057](https://insights.sbomify.com/CVE-2024-56057/): WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-56056](https://insights.sbomify.com/CVE-2024-56056/): WordPress SimpleCharm Theme <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56055](https://insights.sbomify.com/CVE-2024-56055/): WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability (high 8.5)
- [CVE-2024-56054](https://insights.sbomify.com/CVE-2024-56054/): WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-56053](https://insights.sbomify.com/CVE-2024-56053/): WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability (high 7.6)
- [CVE-2024-56052](https://insights.sbomify.com/CVE-2024-56052/): WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-56051](https://insights.sbomify.com/CVE-2024-56051/): WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability (high 8.5)
- [CVE-2024-56050](https://insights.sbomify.com/CVE-2024-56050/): WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-5605](https://insights.sbomify.com/CVE-2024-5605/): Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter (high 8.8)
- [CVE-2024-56049](https://insights.sbomify.com/CVE-2024-56049/): WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability (high 8.5)
- [CVE-2024-56048](https://insights.sbomify.com/CVE-2024-56048/): WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-56047](https://insights.sbomify.com/CVE-2024-56047/): WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability (high 8.5)
- [CVE-2024-56046](https://insights.sbomify.com/CVE-2024-56046/): WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-56045](https://insights.sbomify.com/CVE-2024-56045/): WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability (critical 9.3)
- [CVE-2024-56044](https://insights.sbomify.com/CVE-2024-56044/): WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability (critical 9.8)
- [CVE-2024-56043](https://insights.sbomify.com/CVE-2024-56043/): WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-56042](https://insights.sbomify.com/CVE-2024-56042/): WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-56041](https://insights.sbomify.com/CVE-2024-56041/): WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-56040](https://insights.sbomify.com/CVE-2024-56040/): WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-5604](https://insights.sbomify.com/CVE-2024-5604/): Bug Library < 2.1.2 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-56039](https://insights.sbomify.com/CVE-2024-56039/): WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-56038](https://insights.sbomify.com/CVE-2024-56038/): WordPress SendSMS Plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56037](https://insights.sbomify.com/CVE-2024-56037/): WordPress User Referral plugin <= 8.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56036](https://insights.sbomify.com/CVE-2024-56036/): WordPress odPhotogallery plugin <= 0.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56035](https://insights.sbomify.com/CVE-2024-56035/): WordPress Upload Scanner plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56034](https://insights.sbomify.com/CVE-2024-56034/): WordPress Services updates for customers plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56033](https://insights.sbomify.com/CVE-2024-56033/): WordPress FAQs plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56032](https://insights.sbomify.com/CVE-2024-56032/): WordPress FV Descriptions plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56031](https://insights.sbomify.com/CVE-2024-56031/): WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability (medium 6.5)
- [CVE-2024-56030](https://insights.sbomify.com/CVE-2024-56030/): WordPress 10CentMail plugin <= 2.1.50 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56029](https://insights.sbomify.com/CVE-2024-56029/): WordPress Easy Language Switcher plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56028](https://insights.sbomify.com/CVE-2024-56028/): Cross-site scripting in Lemonade Social Networks Autoposter Pinterest (high 7.1)
- [CVE-2024-56027](https://insights.sbomify.com/CVE-2024-56027/): WordPress Leads CRM plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56026](https://insights.sbomify.com/CVE-2024-56026/): WordPress Simple Proxy plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56025](https://insights.sbomify.com/CVE-2024-56025/): WordPress AdWork Media EZ Content Locker plugin <= 3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56024](https://insights.sbomify.com/CVE-2024-56024/): WordPress Custom Dashboard Widget plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56023](https://insights.sbomify.com/CVE-2024-56023/): WordPress WP eCommerce Quickpay plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56022](https://insights.sbomify.com/CVE-2024-56022/): WordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56021](https://insights.sbomify.com/CVE-2024-56021/): WordPress Category Post Shortcode Plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56020](https://insights.sbomify.com/CVE-2024-56020/): WordPress SvegliaT Buttons Plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5602](https://insights.sbomify.com/CVE-2024-5602/): Stack-based Buffer Overflow Vulnerability in NI I/O Trace Tool (high 7.8)
- [CVE-2024-56019](https://insights.sbomify.com/CVE-2024-56019/): WordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56018](https://insights.sbomify.com/CVE-2024-56018/): WordPress BU Section Editing Plugin <= 0.9.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56017](https://insights.sbomify.com/CVE-2024-56017/): WordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-56016](https://insights.sbomify.com/CVE-2024-56016/): WordPress Image Mapper plugin <= 0.2.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56015](https://insights.sbomify.com/CVE-2024-56015/): WordPress Tidy Up Plugin <= 1.3 - CSRF to Reflected Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-56014](https://insights.sbomify.com/CVE-2024-56014/): WordPress Olivia Theme <= 0.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56013](https://insights.sbomify.com/CVE-2024-56013/): WordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability (high 8.8)
- [CVE-2024-56012](https://insights.sbomify.com/CVE-2024-56012/): WordPress Flash News / Post (Responsive) plugin <= 4.1 - CSRF to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-56011](https://insights.sbomify.com/CVE-2024-56011/): WordPress Responsive Google Maps | by imbaa plugin <= 1.2.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56010](https://insights.sbomify.com/CVE-2024-56010/): WordPress Device Detector Plugin <= 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5601](https://insights.sbomify.com/CVE-2024-5601/): Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode (medium 6.4)
- [CVE-2024-56009](https://insights.sbomify.com/CVE-2024-56009/): WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-56008](https://insights.sbomify.com/CVE-2024-56008/): WordPress Spreadr Woocommerce plugin <= 1.0.4 - Arbitrary Content Deletion vulnerability (high 7.5)
- [CVE-2024-56007](https://insights.sbomify.com/CVE-2024-56007/): WordPress Leader plugin <= 2.6.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-56006](https://insights.sbomify.com/CVE-2024-56006/): WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-56005](https://insights.sbomify.com/CVE-2024-56005/): WordPress Posti Shipping Plugin <= 3.10.3 - CSRF to Settings Change vulnerability (medium 6.5)
- [CVE-2024-56004](https://insights.sbomify.com/CVE-2024-56004/): WordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerability (medium 5.4)
- [CVE-2024-56003](https://insights.sbomify.com/CVE-2024-56003/): WordPress Caldera SMTP Mailer plugin <= 1.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-56002](https://insights.sbomify.com/CVE-2024-56002/): WordPress Contact Form, Survey & Form Builder – MightyForms plugin <= 1.3.9 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2024-56001](https://insights.sbomify.com/CVE-2024-56001/): WordPress Ksher plugin <= 1.1.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-56000](https://insights.sbomify.com/CVE-2024-56000/): WordPress K Elements plugin < 5.4.0 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2024-5600](https://insights.sbomify.com/CVE-2024-5600/): Missing authorization in SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue (medium 5.4)
- [CVE-2024-55999](https://insights.sbomify.com/CVE-2024-55999/): WordPress XML Multilanguage Sitemap Generator plugin <= 2.0.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-55998](https://insights.sbomify.com/CVE-2024-55998/): WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability (medium 5.4)
- [CVE-2024-55997](https://insights.sbomify.com/CVE-2024-55997/): WordPress Order Delivery & Pickup Location Date Time plugin <= 1.1.0 - Settings Change vulnerability (medium 6.5)
- [CVE-2024-55996](https://insights.sbomify.com/CVE-2024-55996/): WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability (medium 6.1)
- [CVE-2024-55995](https://insights.sbomify.com/CVE-2024-55995/): WordPress Torod plugin <= 1.7 - Settings Change vulnerability (medium 6.5)
- [CVE-2024-55994](https://insights.sbomify.com/CVE-2024-55994/): WordPress 畅言评论系统 plugin <= 2.0.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-55993](https://insights.sbomify.com/CVE-2024-55993/): WordPress Job Board Manager plugin <= 2.1.61 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-55992](https://insights.sbomify.com/CVE-2024-55992/): WordPress WooCommerce Basic Ordernumbers plugin <= 1.4.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-55991](https://insights.sbomify.com/CVE-2024-55991/): WordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-55990](https://insights.sbomify.com/CVE-2024-55990/): WordPress Mollie for Contact Form 7 plugin <= 5.0.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-5599](https://insights.sbomify.com/CVE-2024-5599/): FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listing (high 7.5)
- [CVE-2024-55989](https://insights.sbomify.com/CVE-2024-55989/): WordPress WP Simple Pay Lite Manager Plugin <= 1.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-55988](https://insights.sbomify.com/CVE-2024-55988/): WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55987](https://insights.sbomify.com/CVE-2024-55987/): WordPress Advanced What should we write next about plugin <= 1.0.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55986](https://insights.sbomify.com/CVE-2024-55986/): WordPress Service plugin <= 1.0.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55985](https://insights.sbomify.com/CVE-2024-55985/): WordPress YDS Support Ticket System plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55984](https://insights.sbomify.com/CVE-2024-55984/): WordPress Saksh Escrow System plugin <= 2.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55983](https://insights.sbomify.com/CVE-2024-55983/): WordPress PowerFormBuilder plugin <= 1.0.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55982](https://insights.sbomify.com/CVE-2024-55982/): WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55981](https://insights.sbomify.com/CVE-2024-55981/): WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55980](https://insights.sbomify.com/CVE-2024-55980/): WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-5598](https://insights.sbomify.com/CVE-2024-5598/): Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing (high 7.5)
- [CVE-2024-55979](https://insights.sbomify.com/CVE-2024-55979/): WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55978](https://insights.sbomify.com/CVE-2024-55978/): WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55977](https://insights.sbomify.com/CVE-2024-55977/): WordPress LaunchPage.app Importer plugin <= 1.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55976](https://insights.sbomify.com/CVE-2024-55976/): WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55975](https://insights.sbomify.com/CVE-2024-55975/): WordPress Dr Affiliate plugin <= 1.2.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55974](https://insights.sbomify.com/CVE-2024-55974/): WordPress Mimoos plugin <= 1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-55973](https://insights.sbomify.com/CVE-2024-55973/): WordPress TSB Occasion Editor plugin <= 1.2.1 - SQL Injection vulnerability (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/191/