# Vulnerabilities published in 2024


- [CVE-2024-51889](https://insights.sbomify.com/CVE-2024-51889/): WordPress Fancy User List plugin <= 3.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51888](https://insights.sbomify.com/CVE-2024-51888/): WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-51887](https://insights.sbomify.com/CVE-2024-51887/): WordPress NV Slider plugin <= 1.6 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51886](https://insights.sbomify.com/CVE-2024-51886/): WordPress Posts Filter plugin <= 1.3.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51885](https://insights.sbomify.com/CVE-2024-51885/): WordPress Browsing History plugin <= 1.3.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51884](https://insights.sbomify.com/CVE-2024-51884/): WordPress Posts Search plugin <= 1.2.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51883](https://insights.sbomify.com/CVE-2024-51883/): WordPress I Plant A Tree plugin <= 1.7.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51882](https://insights.sbomify.com/CVE-2024-51882/): WordPress Gboy Custom Google Map plugin <= 1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51881](https://insights.sbomify.com/CVE-2024-51881/): WordPress Be Shortcodes plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51880](https://insights.sbomify.com/CVE-2024-51880/): WordPress BeBetter Social Icons plugin <= 2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5188](https://insights.sbomify.com/CVE-2024-5188/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-51879](https://insights.sbomify.com/CVE-2024-51879/): WordPress Text Advertisements plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51878](https://insights.sbomify.com/CVE-2024-51878/): WordPress AchillesTheme-shortcodes plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51877](https://insights.sbomify.com/CVE-2024-51877/): WordPress SV Forms plugin <= 2.0.05 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51876](https://insights.sbomify.com/CVE-2024-51876/): WordPress wp_automatic_widget plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51875](https://insights.sbomify.com/CVE-2024-51875/): WordPress MDC YouTube Downloader plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51874](https://insights.sbomify.com/CVE-2024-51874/): WordPress ParOne Feeds plugin <= 1.17.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51873](https://insights.sbomify.com/CVE-2024-51873/): WordPress Multi-day Booking Calendar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51872](https://insights.sbomify.com/CVE-2024-51872/): WordPress Luzuk Testimonials plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51871](https://insights.sbomify.com/CVE-2024-51871/): WordPress Luzuk Team plugin <= 0.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51870](https://insights.sbomify.com/CVE-2024-51870/): WordPress Ultimate Flipbox Addon for Elementor plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5187](https://insights.sbomify.com/CVE-2024-5187/): Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx (high 8.8)
- [CVE-2024-51869](https://insights.sbomify.com/CVE-2024-51869/): WordPress Gutenium Blocks plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51868](https://insights.sbomify.com/CVE-2024-51868/): WordPress DuoGeek Blocks plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51867](https://insights.sbomify.com/CVE-2024-51867/): WordPress Simpul Events by Esotech plugin <= 1.8.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51866](https://insights.sbomify.com/CVE-2024-51866/): WordPress Social button plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51865](https://insights.sbomify.com/CVE-2024-51865/): WordPress Simple Social Share Block plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51864](https://insights.sbomify.com/CVE-2024-51864/): WordPress Shortcode Collection plugin <= 1.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51863](https://insights.sbomify.com/CVE-2024-51863/): WordPress PF Timer plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51862](https://insights.sbomify.com/CVE-2024-51862/): WordPress Google Visualization Charts plugin <= 0.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51861](https://insights.sbomify.com/CVE-2024-51861/): WordPress EventPress plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51860](https://insights.sbomify.com/CVE-2024-51860/): WordPress Custom Dashboard Widget plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5186](https://insights.sbomify.com/CVE-2024-5186/): Server Side Request Forgery (SSRF) in imartinez/privategpt (high 8.3)
- [CVE-2024-51859](https://insights.sbomify.com/CVE-2024-51859/): WordPress Bamboo Enquiries plugin <= 1.9.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51858](https://insights.sbomify.com/CVE-2024-51858/): WordPress Social Locker plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51857](https://insights.sbomify.com/CVE-2024-51857/): WordPress Olympus Shortcodes plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51856](https://insights.sbomify.com/CVE-2024-51856/): WordPress Moose Elementor Kit plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51855](https://insights.sbomify.com/CVE-2024-51855/): WordPress Redirecter plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51854](https://insights.sbomify.com/CVE-2024-51854/): WordPress Hola Free Video Player plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51853](https://insights.sbomify.com/CVE-2024-51853/): WordPress Faltu Testimonial Rotator plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51852](https://insights.sbomify.com/CVE-2024-51852/): WordPress Dynamic Post Grid Elementor Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51851](https://insights.sbomify.com/CVE-2024-51851/): WordPress best bootstrap widgets for elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51850](https://insights.sbomify.com/CVE-2024-51850/): WordPress WoW Guild Armory Roster plugin <= 0.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5185](https://insights.sbomify.com/CVE-2024-5185/): Data Poisoning in EmbedAI (high 8.3)
- [CVE-2024-51849](https://insights.sbomify.com/CVE-2024-51849/): WordPress My Restaurant Menu plugin <= 0.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51848](https://insights.sbomify.com/CVE-2024-51848/): WordPress Parallaxer plugin <= 1.00 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51847](https://insights.sbomify.com/CVE-2024-51847/): WordPress WP PagSeguro Payments plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51846](https://insights.sbomify.com/CVE-2024-51846/): WordPress Community Yard Sale plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51845](https://insights.sbomify.com/CVE-2024-51845/): WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51844](https://insights.sbomify.com/CVE-2024-51844/): WordPress Location Click Map plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51843](https://insights.sbomify.com/CVE-2024-51843/): WordPress Horsemanager plugin <= 1.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51842](https://insights.sbomify.com/CVE-2024-51842/): WordPress Image Carousel Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51841](https://insights.sbomify.com/CVE-2024-51841/): WordPress File Select Control For Elementor plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51840](https://insights.sbomify.com/CVE-2024-51840/): WordPress Wd-image-magnifier-xoss plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5184](https://insights.sbomify.com/CVE-2024-5184/): Prompt Injection in EmailGPT (high 8.5)
- [CVE-2024-51839](https://insights.sbomify.com/CVE-2024-51839/): WordPress Utech Spinning Earth plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51838](https://insights.sbomify.com/CVE-2024-51838/): WordPress Pull This plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51837](https://insights.sbomify.com/CVE-2024-51837/): WordPress WP Contest plugin <= 1.0.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51836](https://insights.sbomify.com/CVE-2024-51836/): WordPress Wezido plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51835](https://insights.sbomify.com/CVE-2024-51835/): WordPress OpenCart Product Display plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51834](https://insights.sbomify.com/CVE-2024-51834/): WordPress Luzuk Slider plugin <= 0.1.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51833](https://insights.sbomify.com/CVE-2024-51833/): WordPress Easy Social Sharebar plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51832](https://insights.sbomify.com/CVE-2024-51832/): WordPress Plenigo plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51831](https://insights.sbomify.com/CVE-2024-51831/): WordPress Persian Nested Show/Hide Text plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51830](https://insights.sbomify.com/CVE-2024-51830/): WordPress News Ticker plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51829](https://insights.sbomify.com/CVE-2024-51829/): WordPress Mobile Kiosk plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51828](https://insights.sbomify.com/CVE-2024-51828/): WordPress Beacon For Help Scout plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51827](https://insights.sbomify.com/CVE-2024-51827/): WordPress Boombox Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51826](https://insights.sbomify.com/CVE-2024-51826/): WordPress Bitcoin Payments plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51825](https://insights.sbomify.com/CVE-2024-51825/): WordPress Alert Me! plugin <= 0.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51824](https://insights.sbomify.com/CVE-2024-51824/): WordPress Advanced Video Player with Analytics plugin <= 1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51823](https://insights.sbomify.com/CVE-2024-51823/): WordPress Add Ribbon Shortcode plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51822](https://insights.sbomify.com/CVE-2024-51822/): WordPress Creative Blocks plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51821](https://insights.sbomify.com/CVE-2024-51821/): WordPress WE – Client Logo Carousel plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51820](https://insights.sbomify.com/CVE-2024-51820/): WordPress L Squared Hub WP plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-5182](https://insights.sbomify.com/CVE-2024-5182/): Path Traversal in mudler/localai (high 7.5)
- [CVE-2024-51819](https://insights.sbomify.com/CVE-2024-51819/): WordPress Tigris Flexplatform plugin <=1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51818](https://insights.sbomify.com/CVE-2024-51818/): WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-51817](https://insights.sbomify.com/CVE-2024-51817/): WordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerability (medium 5.4)
- [CVE-2024-51816](https://insights.sbomify.com/CVE-2024-51816/): WordPress Banner System plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51815](https://insights.sbomify.com/CVE-2024-51815/): WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerability (critical 9.0)
- [CVE-2024-51814](https://insights.sbomify.com/CVE-2024-51814/): WordPress 活动链接推广插件 plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51813](https://insights.sbomify.com/CVE-2024-51813/): WordPress Anant Addons for Elementor plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51812](https://insights.sbomify.com/CVE-2024-51812/): WordPress Pro Addons For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51811](https://insights.sbomify.com/CVE-2024-51811/): WordPress Popup Image plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51810](https://insights.sbomify.com/CVE-2024-51810/): WordPress Lewe Bootstrap Visuals plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5181](https://insights.sbomify.com/CVE-2024-5181/): Command Injection in mudler/localai (critical 9.8)
- [CVE-2024-51809](https://insights.sbomify.com/CVE-2024-51809/): WordPress Keymaster Chord Notation Free plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51808](https://insights.sbomify.com/CVE-2024-51808/): WordPress codeSnips plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51807](https://insights.sbomify.com/CVE-2024-51807/): WordPress AgendaPress plugin <= 1.0.8 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51806](https://insights.sbomify.com/CVE-2024-51806/): WordPress Awesome Fitness Testimonials plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51805](https://insights.sbomify.com/CVE-2024-51805/): WordPress yPHPlista plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51804](https://insights.sbomify.com/CVE-2024-51804/): WordPress Moka Get Posts Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51803](https://insights.sbomify.com/CVE-2024-51803/): WordPress Inline Click To Tweet plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51802](https://insights.sbomify.com/CVE-2024-51802/): WordPress Bread & Butter plugin <= 7.4.857 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51801](https://insights.sbomify.com/CVE-2024-51801/): WordPress Brand my Footer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51800](https://insights.sbomify.com/CVE-2024-51800/): WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-51799](https://insights.sbomify.com/CVE-2024-51799/): WordPress Bg Patriarchia BU plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51798](https://insights.sbomify.com/CVE-2024-51798/): WordPress Surbma | Font Awesome plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51797](https://insights.sbomify.com/CVE-2024-51797/): WordPress Ultimate Accordion plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/218/