# Vulnerabilities published in 2024


- [CVE-2024-54276](https://insights.sbomify.com/CVE-2024-54276/): WordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54275](https://insights.sbomify.com/CVE-2024-54275/): WordPress CSV to html plugin <= 3.08 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54274](https://insights.sbomify.com/CVE-2024-54274/): WordPress Octrace Support plugin <= 1.2.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54273](https://insights.sbomify.com/CVE-2024-54273/): WordPress Mail Picker plugin <= 1.0.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-54272](https://insights.sbomify.com/CVE-2024-54272/): WordPress Radius Blocks plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54271](https://insights.sbomify.com/CVE-2024-54271/): WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability (medium 5.4)
- [CVE-2024-54270](https://insights.sbomify.com/CVE-2024-54270/): WordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-5427](https://insights.sbomify.com/CVE-2024-5427/): Cross-site scripting in WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System (medium 6.4)
- [CVE-2024-54269](https://insights.sbomify.com/CVE-2024-54269/): WordPress Notibar plugin <= 2.1.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54268](https://insights.sbomify.com/CVE-2024-54268/): WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54267](https://insights.sbomify.com/CVE-2024-54267/): WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54266](https://insights.sbomify.com/CVE-2024-54266/): WordPress ImageRecycle pdf & image compression plugin <= 3.1.16 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54265](https://insights.sbomify.com/CVE-2024-54265/): WordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54264](https://insights.sbomify.com/CVE-2024-54264/): WordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54263](https://insights.sbomify.com/CVE-2024-54263/): WordPress Spirit Framework plugin <= 1.2.13 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54262](https://insights.sbomify.com/CVE-2024-54262/): WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-54261](https://insights.sbomify.com/CVE-2024-54261/): WordPress TAX SERVICE Electronic HDM plugin <= 1.2.2 - SQL Injection vulnerability (critical 10.0)
- [CVE-2024-54260](https://insights.sbomify.com/CVE-2024-54260/): WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5426](https://insights.sbomify.com/CVE-2024-5426/): Cross-site scripting in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 6.4)
- [CVE-2024-54259](https://insights.sbomify.com/CVE-2024-54259/): WordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2024-54258](https://insights.sbomify.com/CVE-2024-54258/): WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-54257](https://insights.sbomify.com/CVE-2024-54257/): WordPress tydskrif theme <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54256](https://insights.sbomify.com/CVE-2024-54256/): WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-54255](https://insights.sbomify.com/CVE-2024-54255/): WordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-54254](https://insights.sbomify.com/CVE-2024-54254/): WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-54253](https://insights.sbomify.com/CVE-2024-54253/): WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54252](https://insights.sbomify.com/CVE-2024-54252/): WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-54251](https://insights.sbomify.com/CVE-2024-54251/): WordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-54250](https://insights.sbomify.com/CVE-2024-54250/): WordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5425](https://insights.sbomify.com/CVE-2024-5425/): WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute (medium 6.4)
- [CVE-2024-54249](https://insights.sbomify.com/CVE-2024-54249/): WordPress Advanced Options Editor plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54248](https://insights.sbomify.com/CVE-2024-54248/): WordPress Eewee Admin Custom plugin <= 1.8.2.4 - CSRF to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-54247](https://insights.sbomify.com/CVE-2024-54247/): WordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54246](https://insights.sbomify.com/CVE-2024-54246/): WordPress FAQs plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54245](https://insights.sbomify.com/CVE-2024-54245/): WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54244](https://insights.sbomify.com/CVE-2024-54244/): WordPress Easy Replace plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54243](https://insights.sbomify.com/CVE-2024-54243/): WordPress Echoza plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54242](https://insights.sbomify.com/CVE-2024-54242/): WordPress Simple Notification plugin <= 1.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-54241](https://insights.sbomify.com/CVE-2024-54241/): WordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54240](https://insights.sbomify.com/CVE-2024-54240/): WordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5424](https://insights.sbomify.com/CVE-2024-5424/): Cross-site scripting in Mixed Media Gallery Blocks (medium 6.4)
- [CVE-2024-54239](https://insights.sbomify.com/CVE-2024-54239/): WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-54238](https://insights.sbomify.com/CVE-2024-54238/): WordPress Board Document Manager from CHUHPL plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54237](https://insights.sbomify.com/CVE-2024-54237/): WordPress Ni CRM Lead plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54236](https://insights.sbomify.com/CVE-2024-54236/): WordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54235](https://insights.sbomify.com/CVE-2024-54235/): WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54234](https://insights.sbomify.com/CVE-2024-54234/): WordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-54233](https://insights.sbomify.com/CVE-2024-54233/): WordPress Advanced Control Manager plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54232](https://insights.sbomify.com/CVE-2024-54232/): WordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54231](https://insights.sbomify.com/CVE-2024-54231/): WordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54230](https://insights.sbomify.com/CVE-2024-54230/): WordPress Unlock Addons for Elementor plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5423](https://insights.sbomify.com/CVE-2024-5423/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-54229](https://insights.sbomify.com/CVE-2024-54229/): WordPress SV100 Companion plugin <= 2.0.02 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-54228](https://insights.sbomify.com/CVE-2024-54228/): WordPress Wot Elementor Widgets plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54227](https://insights.sbomify.com/CVE-2024-54227/): WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-54226](https://insights.sbomify.com/CVE-2024-54226/): WordPress Country Blocker plugin <= 3.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-54225](https://insights.sbomify.com/CVE-2024-54225/): WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-54224](https://insights.sbomify.com/CVE-2024-54224/): WordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54223](https://insights.sbomify.com/CVE-2024-54223/): WordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerability (medium 5.3)
- [CVE-2024-54222](https://insights.sbomify.com/CVE-2024-54222/): WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-54221](https://insights.sbomify.com/CVE-2024-54221/): WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-54220](https://insights.sbomify.com/CVE-2024-54220/): WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5422](https://insights.sbomify.com/CVE-2024-5422/): Denial of Service (high 7.1)
- [CVE-2024-54219](https://insights.sbomify.com/CVE-2024-54219/): WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54218](https://insights.sbomify.com/CVE-2024-54218/): WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability (medium 6.5)
- [CVE-2024-54217](https://insights.sbomify.com/CVE-2024-54217/): WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability (medium 5.4)
- [CVE-2024-54216](https://insights.sbomify.com/CVE-2024-54216/): WordPress ARForms plugin < 7.0.2 - Path Traversal vulnerability (high 7.7)
- [CVE-2024-54215](https://insights.sbomify.com/CVE-2024-54215/): WordPress Revy plugin <= 1.18 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-54214](https://insights.sbomify.com/CVE-2024-54214/): WordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-54213](https://insights.sbomify.com/CVE-2024-54213/): WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54212](https://insights.sbomify.com/CVE-2024-54212/): WordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-54211](https://insights.sbomify.com/CVE-2024-54211/): Cross-site scripting in Borderless (medium 5.9)
- [CVE-2024-54210](https://insights.sbomify.com/CVE-2024-54210/): WordPress Advanced Element Bucket Addons for Elementor plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5421](https://insights.sbomify.com/CVE-2024-5421/): Authenticated Command Injection (high 8.7)
- [CVE-2024-54209](https://insights.sbomify.com/CVE-2024-54209/): WordPress Awesome Shortcodes plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54208](https://insights.sbomify.com/CVE-2024-54208/): WordPress Block Controller plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-54207](https://insights.sbomify.com/CVE-2024-54207/): WordPress WordPress Auction Plugin plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-54206](https://insights.sbomify.com/CVE-2024-54206/): WordPress Z-Downloads plugin <= 1.11.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-54205](https://insights.sbomify.com/CVE-2024-54205/): WordPress Paloma Widget plugin <= 1.14 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5420](https://insights.sbomify.com/CVE-2024-5420/): Stored Cross-Site Scripting in SEH Computertechnik utnserver Pro (high 8.3)
- [CVE-2024-54198](https://insights.sbomify.com/CVE-2024-54198/): Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP (high 8.5)
- [CVE-2024-54197](https://insights.sbomify.com/CVE-2024-54197/): Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview) (high 7.2)
- [CVE-2024-54193](https://insights.sbomify.com/CVE-2024-54193/): accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() (medium 5.5)
- [CVE-2024-54192](https://insights.sbomify.com/CVE-2024-54192/): An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial of service via a crafted file to the tcpedit_dlt_getplugin function at (medium 5.5)
- [CVE-2024-54191](https://insights.sbomify.com/CVE-2024-54191/): Bluetooth: iso: Fix circular lock in iso_conn_big_sync (medium 5.5)
- [CVE-2024-5419](https://insights.sbomify.com/CVE-2024-5419/): Cross-site scripting in Void Contact Form 7 Widget For Elementor Page Builder (medium 6.4)
- [CVE-2024-54189](https://insights.sbomify.com/CVE-2024-54189/): Privilege escalation in Parallels Desktop for Mac (high 7.8)
- [CVE-2024-54188](https://insights.sbomify.com/CVE-2024-54188/): Information disclosure in infoblox:netmri (medium 5.3)
- [CVE-2024-54183](https://insights.sbomify.com/CVE-2024-54183/): IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting (medium 5.4)
- [CVE-2024-54181](https://insights.sbomify.com/CVE-2024-54181/): IBM WebSphere Automation command injection (high 7.2)
- [CVE-2024-5418](https://insights.sbomify.com/CVE-2024-5418/): DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute (medium 6.4)
- [CVE-2024-54179](https://insights.sbomify.com/CVE-2024-54179/): IBM Business Automation Workflow cross-site scripting (medium 5.4)
- [CVE-2024-54178](https://insights.sbomify.com/CVE-2024-54178/): Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data. (medium 6.5)
- [CVE-2024-54176](https://insights.sbomify.com/CVE-2024-54176/): IBM UrbanCode Deploy missing authentication (medium 4.3)
- [CVE-2024-54175](https://insights.sbomify.com/CVE-2024-54175/): IBM MQ denial of service (medium 5.5)
- [CVE-2024-54173](https://insights.sbomify.com/CVE-2024-54173/): IBM MQ information disclosure (medium 4.7)
- [CVE-2024-54172](https://insights.sbomify.com/CVE-2024-54172/): IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site request forgery (medium 4.3)
- [CVE-2024-54171](https://insights.sbomify.com/CVE-2024-54171/): IBM EntireX XML external entity injection (high 7.1)
- [CVE-2024-54170](https://insights.sbomify.com/CVE-2024-54170/): IBM EntireX denial of service (medium 5.5)
- [CVE-2024-5417](https://insights.sbomify.com/CVE-2024-5417/): Gutentor < 3.3.6 - Contributor+ Stored XSS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/200/