# Vulnerabilities published in 2024


- [CVE-2024-52467](https://insights.sbomify.com/CVE-2024-52467/): WordPress AI Responsive Gallery Album plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52466](https://insights.sbomify.com/CVE-2024-52466/): WordPress Explara Events plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52465](https://insights.sbomify.com/CVE-2024-52465/): WordPress LGPD Framework plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52464](https://insights.sbomify.com/CVE-2024-52464/): WordPress amr shortcodes plugin <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52463](https://insights.sbomify.com/CVE-2024-52463/): WordPress Post By Email plugin <= 1.0.4b - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52462](https://insights.sbomify.com/CVE-2024-52462/): WordPress WP e-Commerce Style Email plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52461](https://insights.sbomify.com/CVE-2024-52461/): WordPress Infinite Slider plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52460](https://insights.sbomify.com/CVE-2024-52460/): WordPress AtaraPay WooCommerce Payment Gateway plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5246](https://insights.sbomify.com/CVE-2024-5246/): NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52459](https://insights.sbomify.com/CVE-2024-52459/): WordPress Chameleoni Jobs plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52458](https://insights.sbomify.com/CVE-2024-52458/): WordPress TM Islamic Helper plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52457](https://insights.sbomify.com/CVE-2024-52457/): WordPress Youneeq Recommendations plugin <= 3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52456](https://insights.sbomify.com/CVE-2024-52456/): WordPress Awesome Studio plugin <= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52455](https://insights.sbomify.com/CVE-2024-52455/): WordPress GoQSmile plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52454](https://insights.sbomify.com/CVE-2024-52454/): WordPress GoQMieruca plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52453](https://insights.sbomify.com/CVE-2024-52453/): WordPress Library Bookshelves plugin <= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52452](https://insights.sbomify.com/CVE-2024-52452/): WordPress Open edX LMS plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52451](https://insights.sbomify.com/CVE-2024-52451/): WordPress Post Ideas plugin <= 2 - CSRF to SQL Injection vulnerability (high 8.2)
- [CVE-2024-52450](https://insights.sbomify.com/CVE-2024-52450/): WordPress nBlocks plugin <= 1.0.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-5245](https://insights.sbomify.com/CVE-2024-5245/): NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-52449](https://insights.sbomify.com/CVE-2024-52449/): WordPress WordPress Bootscraper plugin <= 2.1.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52448](https://insights.sbomify.com/CVE-2024-52448/): WordPress Ultimate Classified Listings plugin <= 1.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52447](https://insights.sbomify.com/CVE-2024-52447/): WordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-52446](https://insights.sbomify.com/CVE-2024-52446/): WordPress Buying Buddy IDX CRM plugin <= 1.2.8 - CSRF to PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-52445](https://insights.sbomify.com/CVE-2024-52445/): WordPress QRMenu Restaurant QR Menu Lite plugin <= 1.0.4 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-52444](https://insights.sbomify.com/CVE-2024-52444/): WordPress Opal Woo Custom Product Variation plugin <= 1.1.3 - Arbitrary File Deletion vulnerability (high 7.5)
- [CVE-2024-52443](https://insights.sbomify.com/CVE-2024-52443/): WordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52442](https://insights.sbomify.com/CVE-2024-52442/): WordPress UserPlus plugin <= 2.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-52441](https://insights.sbomify.com/CVE-2024-52441/): WordPress Quick Learn plugin <= 1.0.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52440](https://insights.sbomify.com/CVE-2024-52440/): WordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-5244](https://insights.sbomify.com/CVE-2024-5244/): TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability (medium 5.0)
- [CVE-2024-52439](https://insights.sbomify.com/CVE-2024-52439/): WordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52438](https://insights.sbomify.com/CVE-2024-52438/): WordPress de:branding plugin <= 1.0.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-52437](https://insights.sbomify.com/CVE-2024-52437/): WordPress Banner System plugin <= 1.0.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-52436](https://insights.sbomify.com/CVE-2024-52436/): WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-52435](https://insights.sbomify.com/CVE-2024-52435/): WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.0.5 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-52434](https://insights.sbomify.com/CVE-2024-52434/): WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-52433](https://insights.sbomify.com/CVE-2024-52433/): WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52432](https://insights.sbomify.com/CVE-2024-52432/): WordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52431](https://insights.sbomify.com/CVE-2024-52431/): WordPress WP Video Robot plugin <= 1.20.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-52430](https://insights.sbomify.com/CVE-2024-52430/): WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-5243](https://insights.sbomify.com/CVE-2024-5243/): TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-52429](https://insights.sbomify.com/CVE-2024-52429/): WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability (critical 9.9)
- [CVE-2024-52428](https://insights.sbomify.com/CVE-2024-52428/): WordPress Ads Booster by Ads Pro plugin <= 1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-52427](https://insights.sbomify.com/CVE-2024-52427/): WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-52426](https://insights.sbomify.com/CVE-2024-52426/): WordPress Linear plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52425](https://insights.sbomify.com/CVE-2024-52425/): WordPress Drozd – Addons for Elementor plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52424](https://insights.sbomify.com/CVE-2024-52424/): WordPress wp-login customizer plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52423](https://insights.sbomify.com/CVE-2024-52423/): WordPress Themify Builder plugin <= 7.6.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52422](https://insights.sbomify.com/CVE-2024-52422/): WordPress WP Githuber MD plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52421](https://insights.sbomify.com/CVE-2024-52421/): WordPress WP Popup Window Maker plugin <= 2.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-52420](https://insights.sbomify.com/CVE-2024-52420/): WordPress Disable Admin Notices individually plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-5242](https://insights.sbomify.com/CVE-2024-5242/): TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-52419](https://insights.sbomify.com/CVE-2024-52419/): WordPress Copy Anything to Clipboard plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52418](https://insights.sbomify.com/CVE-2024-52418/): WordPress Gameplan theme <= 1.5.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52417](https://insights.sbomify.com/CVE-2024-52417/): WordPress ReConstruction theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52416](https://insights.sbomify.com/CVE-2024-52416/): WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability (critical 10.0)
- [CVE-2024-52415](https://insights.sbomify.com/CVE-2024-52415/): WordPress SK WP Settings Backup plugin <= 1.0 - CSRF to PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-52414](https://insights.sbomify.com/CVE-2024-52414/): WordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52413](https://insights.sbomify.com/CVE-2024-52413/): WordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52412](https://insights.sbomify.com/CVE-2024-52412/): WordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52411](https://insights.sbomify.com/CVE-2024-52411/): WordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52410](https://insights.sbomify.com/CVE-2024-52410/): WordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-5241](https://insights.sbomify.com/CVE-2024-5241/): Huashi Private Cloud CDN Live Streaming Acceleration Server ipconfig_new.php os command injection (medium 5.1)
- [CVE-2024-52409](https://insights.sbomify.com/CVE-2024-52409/): WordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-52408](https://insights.sbomify.com/CVE-2024-52408/): WordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52407](https://insights.sbomify.com/CVE-2024-52407/): WordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52406](https://insights.sbomify.com/CVE-2024-52406/): WordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52405](https://insights.sbomify.com/CVE-2024-52405/): WordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52404](https://insights.sbomify.com/CVE-2024-52404/): WordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52403](https://insights.sbomify.com/CVE-2024-52403/): WordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52402](https://insights.sbomify.com/CVE-2024-52402/): WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2024-52401](https://insights.sbomify.com/CVE-2024-52401/): WordPress Hacklog DownloadManager plugin <=2.1.4 - CSRF to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2024-52400](https://insights.sbomify.com/CVE-2024-52400/): WordPress Gallerio plugin <= 1.01 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-5240](https://insights.sbomify.com/CVE-2024-5240/): Campcodes Complete Web-Based School Management System unread_msg.php sql injection (medium 5.3)
- [CVE-2024-52399](https://insights.sbomify.com/CVE-2024-52399/): WordPress Writer Helper plugin <= 3.1.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-52398](https://insights.sbomify.com/CVE-2024-52398/): WordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-52397](https://insights.sbomify.com/CVE-2024-52397/): WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-52396](https://insights.sbomify.com/CVE-2024-52396/): WordPress WOLF plugin <= 1.0.8.3 - CSV Limited Path Traversal vulnerability (medium 4.9)
- [CVE-2024-52395](https://insights.sbomify.com/CVE-2024-52395/): WordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-52394](https://insights.sbomify.com/CVE-2024-52394/): WordPress Print PDF Generator and Publisher plugin <= 1.1.6 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52393](https://insights.sbomify.com/CVE-2024-52393/): WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-52392](https://insights.sbomify.com/CVE-2024-52392/): WordPress W3SPEEDSTER plugin <= 7.25 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.3)
- [CVE-2024-52391](https://insights.sbomify.com/CVE-2024-52391/): WordPress Pie Register Premium plugin < 3.8.3.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-52390](https://insights.sbomify.com/CVE-2024-52390/): WordPress CYAN Backup plugin <= 2.5.3 - Arbitrary File Download vulnerability (medium 4.9)
- [CVE-2024-5239](https://insights.sbomify.com/CVE-2024-5239/): Campcodes Complete Web-Based School Management System timetable_update_form.php sql injection (medium 5.3)
- [CVE-2024-52389](https://insights.sbomify.com/CVE-2024-52389/): WordPress WP Job Portal plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52388](https://insights.sbomify.com/CVE-2024-52388/): WordPress Hebrew Date plugin <= 2.1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-52387](https://insights.sbomify.com/CVE-2024-52387/): WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52386](https://insights.sbomify.com/CVE-2024-52386/): WordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerability (medium 5.3)
- [CVE-2024-52385](https://insights.sbomify.com/CVE-2024-52385/): WordPress Team Member – Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion vulnerability (medium 4.3)
- [CVE-2024-52384](https://insights.sbomify.com/CVE-2024-52384/): File upload in Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation (critical 9.9)
- [CVE-2024-52383](https://insights.sbomify.com/CVE-2024-52383/): WordPress Ai Auto Tool Content Writing Assistant plugin <= 2.1.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-52382](https://insights.sbomify.com/CVE-2024-52382/): WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-52381](https://insights.sbomify.com/CVE-2024-52381/): WordPress ZIJ KART plugin <= 1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-52380](https://insights.sbomify.com/CVE-2024-52380/): WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-5238](https://insights.sbomify.com/CVE-2024-5238/): Campcodes Complete Web-Based School Management System timetable_insert_form.php sql injection (medium 5.3)
- [CVE-2024-52379](https://insights.sbomify.com/CVE-2024-52379/): WordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-52378](https://insights.sbomify.com/CVE-2024-52378/): WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-52377](https://insights.sbomify.com/CVE-2024-52377/): File upload in Instant Image Generator (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/214/