# Vulnerabilities published in 2024


- [CVE-2024-54368](https://insights.sbomify.com/CVE-2024-54368/): WordPress GitSync plugin <= 1.1.0 - CSRF to Remote Code Execution vulnerability (critical 9.6)
- [CVE-2024-54367](https://insights.sbomify.com/CVE-2024-54367/): WordPress ForumWP plugin <= 2.1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-54366](https://insights.sbomify.com/CVE-2024-54366/): WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability (medium 5.3)
- [CVE-2024-54365](https://insights.sbomify.com/CVE-2024-54365/): WordPress KH Easy User Settings plugin <= 1.0.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-54364](https://insights.sbomify.com/CVE-2024-54364/): WordPress Feedpress Generator plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54363](https://insights.sbomify.com/CVE-2024-54363/): WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-54362](https://insights.sbomify.com/CVE-2024-54362/): WordPress GetShop ecommerce plugin <= 1.3 - Path Traversal vulnerability (high 8.1)
- [CVE-2024-54361](https://insights.sbomify.com/CVE-2024-54361/): WordPress Instant Appointment plugin <= 1.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-54360](https://insights.sbomify.com/CVE-2024-54360/): WordPress Gutensee plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5436](https://insights.sbomify.com/CVE-2024-5436/): Type Confusion in Snapchat Lenscore (high 7.3)
- [CVE-2024-54359](https://insights.sbomify.com/CVE-2024-54359/): WordPress Banner System plugin <= 1.0.0 - Broken Access Control vulnerability (high 8.2)
- [CVE-2024-54358](https://insights.sbomify.com/CVE-2024-54358/): WordPress 3D Avatar User Profile plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54357](https://insights.sbomify.com/CVE-2024-54357/): WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-54356](https://insights.sbomify.com/CVE-2024-54356/): Cross-site request forgery in Online Booking & Scheduling Calendar for WordPress by vcita (medium 5.4)
- [CVE-2024-54355](https://insights.sbomify.com/CVE-2024-54355/): WordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-54354](https://insights.sbomify.com/CVE-2024-54354/): WordPress Termin-Kalender plugin <= 0.99.47 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-54353](https://insights.sbomify.com/CVE-2024-54353/): WordPress Hack-Info plugin <= 3.17 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54352](https://insights.sbomify.com/CVE-2024-54352/): WordPress Sogrid plugin <= 1.5.2 - CSRF to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-54351](https://insights.sbomify.com/CVE-2024-54351/): WordPress Fancy Roller Scroller plugin <= 1.4.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54350](https://insights.sbomify.com/CVE-2024-54350/): WordPress hmd theme <= 2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5435](https://insights.sbomify.com/CVE-2024-5435/): Generation of Error Message Containing Sensitive Information in GitLab (medium 4.5)
- [CVE-2024-54349](https://insights.sbomify.com/CVE-2024-54349/): WordPress Plain Post plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54348](https://insights.sbomify.com/CVE-2024-54348/): WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54347](https://insights.sbomify.com/CVE-2024-54347/): WordPress FloristPress plugin <= 7.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54346](https://insights.sbomify.com/CVE-2024-54346/): WordPress Barter theme <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54345](https://insights.sbomify.com/CVE-2024-54345/): WordPress Bicycleshop theme <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54344](https://insights.sbomify.com/CVE-2024-54344/): WordPress WP Quick Shop plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54343](https://insights.sbomify.com/CVE-2024-54343/): WordPress Connect Contact Form 7 to Constant Contact plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54342](https://insights.sbomify.com/CVE-2024-54342/): WordPress Staggs plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54341](https://insights.sbomify.com/CVE-2024-54341/): WordPress LabelGrid Tools plugin <= 1.3.58 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54340](https://insights.sbomify.com/CVE-2024-54340/): WordPress Simple Presenter plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5434](https://insights.sbomify.com/CVE-2024-5434/): Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMC (medium 6.9)
- [CVE-2024-54339](https://insights.sbomify.com/CVE-2024-54339/): WordPress geoFlickr plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54338](https://insights.sbomify.com/CVE-2024-54338/): WordPress Hello Event Widgets For Elementor plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54337](https://insights.sbomify.com/CVE-2024-54337/): WordPress DX Dark Site plugin <= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54336](https://insights.sbomify.com/CVE-2024-54336/): WordPress Projectopia plugin <= 5.1.7 - Account Takeover vulnerability (high 8.8)
- [CVE-2024-54335](https://insights.sbomify.com/CVE-2024-54335/): WordPress ImmoToolBox Connect plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54334](https://insights.sbomify.com/CVE-2024-54334/): WordPress Quran Phrases About Most People Shortcodes plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54333](https://insights.sbomify.com/CVE-2024-54333/): WordPress Check Pincode For Woocommerce plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54332](https://insights.sbomify.com/CVE-2024-54332/): WordPress WP Currency Exchange Rates plugin <= 1.2.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54331](https://insights.sbomify.com/CVE-2024-54331/): WordPress I Plant A Tree plugin <= 1.7.3 - CSRF to Stored Cross-Site Scripting vulnerability (high 7.1)
- [CVE-2024-54330](https://insights.sbomify.com/CVE-2024-54330/): WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2024-5433](https://insights.sbomify.com/CVE-2024-5433/): Path Traversal in Campbell Scientific CSI Web Server and RTMC (medium 5.3)
- [CVE-2024-54329](https://insights.sbomify.com/CVE-2024-54329/): WordPress CleverNode Related Content plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54328](https://insights.sbomify.com/CVE-2024-54328/): WordPress Invoice Payment for WooCommerce plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54327](https://insights.sbomify.com/CVE-2024-54327/): WordPress UNIVERSAM plugin < 8.59 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54326](https://insights.sbomify.com/CVE-2024-54326/): WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-54325](https://insights.sbomify.com/CVE-2024-54325/): WordPress CarDealerPress plugin <= 6.6.2410.02 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54324](https://insights.sbomify.com/CVE-2024-54324/): WordPress SMSify plugin <= 6.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54323](https://insights.sbomify.com/CVE-2024-54323/): WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-54322](https://insights.sbomify.com/CVE-2024-54322/): WordPress Media Downloader plugin <= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54321](https://insights.sbomify.com/CVE-2024-54321/): WordPress Hive Support plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-54320](https://insights.sbomify.com/CVE-2024-54320/): WordPress ICDSoft Reseller Store plugin<= 2.4.5 -Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5432](https://insights.sbomify.com/CVE-2024-5432/): Lifeline Donation <= 1.2.6 - Authentication Bypass (critical 9.8)
- [CVE-2024-54319](https://insights.sbomify.com/CVE-2024-54319/): WordPress Kundgenerator plugin <= 1.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54318](https://insights.sbomify.com/CVE-2024-54318/): WordPress NiceJob plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54317](https://insights.sbomify.com/CVE-2024-54317/): WordPress Web Stories plugin <= 1.37.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54316](https://insights.sbomify.com/CVE-2024-54316/): WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54315](https://insights.sbomify.com/CVE-2024-54315/): WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54314](https://insights.sbomify.com/CVE-2024-54314/): WordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54313](https://insights.sbomify.com/CVE-2024-54313/): WordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-54312](https://insights.sbomify.com/CVE-2024-54312/): Cross-site scripting in Persian Woocommerce SMS (high 7.1)
- [CVE-2024-54311](https://insights.sbomify.com/CVE-2024-54311/): WordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-54310](https://insights.sbomify.com/CVE-2024-54310/): WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-5431](https://insights.sbomify.com/CVE-2024-5431/): Path traversal in WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System (high 8.8)
- [CVE-2024-54309](https://insights.sbomify.com/CVE-2024-54309/): WordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2024-54308](https://insights.sbomify.com/CVE-2024-54308/): WordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-54307](https://insights.sbomify.com/CVE-2024-54307/): WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-54306](https://insights.sbomify.com/CVE-2024-54306/): Cross-site request forgery in AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot (medium 4.3)
- [CVE-2024-54305](https://insights.sbomify.com/CVE-2024-54305/): WordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54304](https://insights.sbomify.com/CVE-2024-54304/): WordPress Hive Support plugin <= 1.1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-54303](https://insights.sbomify.com/CVE-2024-54303/): WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54302](https://insights.sbomify.com/CVE-2024-54302/): WordPress VForm plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54301](https://insights.sbomify.com/CVE-2024-54301/): WordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54300](https://insights.sbomify.com/CVE-2024-54300/): WordPress AutoWP plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-5430](https://insights.sbomify.com/CVE-2024-5430/): Improper Access Control in GitLab (medium 6.8)
- [CVE-2024-54299](https://insights.sbomify.com/CVE-2024-54299/): WordPress Revi.io plugin <= 5.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54298](https://insights.sbomify.com/CVE-2024-54298/): WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54297](https://insights.sbomify.com/CVE-2024-54297/): WordPress vBSSO-lite plugin <= 1.4.3 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-54296](https://insights.sbomify.com/CVE-2024-54296/): WordPress CoSchool LMS plugin <= 1.4.3 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-54295](https://insights.sbomify.com/CVE-2024-54295/): WordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-54294](https://insights.sbomify.com/CVE-2024-54294/): WordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-54293](https://insights.sbomify.com/CVE-2024-54293/): WordPress CE21 Suite plugin <= 2.2.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-54292](https://insights.sbomify.com/CVE-2024-54292/): WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-54291](https://insights.sbomify.com/CVE-2024-54291/): WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability (high 8.6)
- [CVE-2024-54290](https://insights.sbomify.com/CVE-2024-54290/): WordPress Role Includer plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5429](https://insights.sbomify.com/CVE-2024-5429/): Logo Slider < 4.1.0 - Contributor+ Stored XSS (high 7.6)
- [CVE-2024-54289](https://insights.sbomify.com/CVE-2024-54289/): WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-54288](https://insights.sbomify.com/CVE-2024-54288/): WordPress LDD Directory Lite plugin <= 3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54287](https://insights.sbomify.com/CVE-2024-54287/): WordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54286](https://insights.sbomify.com/CVE-2024-54286/): WordPress Smaily for WP plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54285](https://insights.sbomify.com/CVE-2024-54285/): WordPress SeedProd Pro plugin <= 6.18.10 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-54284](https://insights.sbomify.com/CVE-2024-54284/): WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-54283](https://insights.sbomify.com/CVE-2024-54283/): WordPress SeedProd Pro plugin <= 6.18.10 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-54282](https://insights.sbomify.com/CVE-2024-54282/): WordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2024-54280](https://insights.sbomify.com/CVE-2024-54280/): WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-5428](https://insights.sbomify.com/CVE-2024-5428/): SourceCodester Simple Online Bidding System HTTP POST Request save_product cross-site request forgery (medium 6.9)
- [CVE-2024-54279](https://insights.sbomify.com/CVE-2024-54279/): WordPress WP-NERD Toolkit plugin <= 1.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-54278](https://insights.sbomify.com/CVE-2024-54278/): WordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54277](https://insights.sbomify.com/CVE-2024-54277/): WordPress Nias course plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/199/