# Vulnerabilities published in 2024


- [CVE-2024-51695](https://insights.sbomify.com/CVE-2024-51695/): WordPress Fabrica Synced Pattern Instances plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51694](https://insights.sbomify.com/CVE-2024-51694/): WordPress Geotagged Media plugin <= 0.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51693](https://insights.sbomify.com/CVE-2024-51693/): Cross-site scripting in Search order by product SKU for WooCommerce (high 7.1)
- [CVE-2024-51692](https://insights.sbomify.com/CVE-2024-51692/): WordPress Bing Search API Integration plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51691](https://insights.sbomify.com/CVE-2024-51691/): WordPress Admin Amplify plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51690](https://insights.sbomify.com/CVE-2024-51690/): WordPress Wp Slide Categorywise plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5169](https://insights.sbomify.com/CVE-2024-5169/): Video Widget <= 1.2.3 - Admin+ Stored XSS via Widget (medium 4.3)
- [CVE-2024-51689](https://insights.sbomify.com/CVE-2024-51689/): WordPress CF7 WOW Styler plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51688](https://insights.sbomify.com/CVE-2024-51688/): WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51687](https://insights.sbomify.com/CVE-2024-51687/): WordPress Platform.ly Official plugin <= 1.1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51686](https://insights.sbomify.com/CVE-2024-51686/): WordPress Manage User Columns plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-51685](https://insights.sbomify.com/CVE-2024-51685/): WordPress Accordion title for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-51684](https://insights.sbomify.com/CVE-2024-51684/): WordPress W3P SEO plugin < 1.8.6 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51683](https://insights.sbomify.com/CVE-2024-51683/): WordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51682](https://insights.sbomify.com/CVE-2024-51682/): Cross-site scripting in HT Builder – WordPress Theme Builder for Elementor (medium 6.5)
- [CVE-2024-51681](https://insights.sbomify.com/CVE-2024-51681/): WordPress WP Pocket URLs plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51680](https://insights.sbomify.com/CVE-2024-51680/): WordPress Cresta Addons for Elementor plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5168](https://insights.sbomify.com/CVE-2024-5168/): Improper access control vulnerability in Prodys Quantum Audio codec (critical 9.8)
- [CVE-2024-51679](https://insights.sbomify.com/CVE-2024-51679/): WordPress Appointmind plugin <= 4.0.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51678](https://insights.sbomify.com/CVE-2024-51678/): WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51677](https://insights.sbomify.com/CVE-2024-51677/): WordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51676](https://insights.sbomify.com/CVE-2024-51676/): WordPress Delisho plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51675](https://insights.sbomify.com/CVE-2024-51675/): WordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51674](https://insights.sbomify.com/CVE-2024-51674/): WordPress Sastra Essential Addons for Elementor plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51673](https://insights.sbomify.com/CVE-2024-51673/): WordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51672](https://insights.sbomify.com/CVE-2024-51672/): WordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-51671](https://insights.sbomify.com/CVE-2024-51671/): WordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability (low 2.7)
- [CVE-2024-51670](https://insights.sbomify.com/CVE-2024-51670/): WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-5167](https://insights.sbomify.com/CVE-2024-5167/): Cross-site request forgery in CM Email Registration Blacklist and Whitelist (high 8.1)
- [CVE-2024-51669](https://insights.sbomify.com/CVE-2024-51669/): WordPress Dynamic Widgets plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-51668](https://insights.sbomify.com/CVE-2024-51668/): WordPress MyCurator Content Curation plugin <= 3.78 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-51667](https://insights.sbomify.com/CVE-2024-51667/): WordPress paytium plugin <= 4.4.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-51666](https://insights.sbomify.com/CVE-2024-51666/): WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-51665](https://insights.sbomify.com/CVE-2024-51665/): WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-51664](https://insights.sbomify.com/CVE-2024-51664/): WordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-51663](https://insights.sbomify.com/CVE-2024-51663/): WordPress Bricksable for Bricks Builder plugin <= 1.6.59 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-51662](https://insights.sbomify.com/CVE-2024-51662/): WordPress Black Widgets For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51661](https://insights.sbomify.com/CVE-2024-51661/): WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-51660](https://insights.sbomify.com/CVE-2024-51660/): WordPress Easy Accordion Gutenberg Block plugin <= 1.2.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-5166](https://insights.sbomify.com/CVE-2024-5166/): Insecure Direct Object Reference In Looker (medium 6.5)
- [CVE-2024-51659](https://insights.sbomify.com/CVE-2024-51659/): WordPress Twitter @Anywhere Plus plugin <= 2.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51658](https://insights.sbomify.com/CVE-2024-51658/): WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51657](https://insights.sbomify.com/CVE-2024-51657/): WordPress SmartLink Dynamic URLs plugin <= 1.1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51656](https://insights.sbomify.com/CVE-2024-51656/): WordPress Flash Show And Hide Box plugin <= 1.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51655](https://insights.sbomify.com/CVE-2024-51655/): WordPress Custom Author URL plugin <= 2.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51654](https://insights.sbomify.com/CVE-2024-51654/): WordPress APK Downloader plugin <= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51653](https://insights.sbomify.com/CVE-2024-51653/): WordPress UPDATE NOTIFICATIONS plugin <= 0.3.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51652](https://insights.sbomify.com/CVE-2024-51652/): WordPress Skip To plugin <= 2.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51651](https://insights.sbomify.com/CVE-2024-51651/): WordPress CubeWP Forms plugin <= 1.1.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-51650](https://insights.sbomify.com/CVE-2024-51650/): WordPress Random Featured Post plugin <= 1.1.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5165](https://insights.sbomify.com/CVE-2024-5165/): Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input (medium 6.5)
- [CVE-2024-51649](https://insights.sbomify.com/CVE-2024-51649/): WordPress Mobilize plugin <= 3.0.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51648](https://insights.sbomify.com/CVE-2024-51648/): WordPress e-shops plugin 1.0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51647](https://insights.sbomify.com/CVE-2024-51647/): WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51646](https://insights.sbomify.com/CVE-2024-51646/): WordPress Saoshyant Element plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51645](https://insights.sbomify.com/CVE-2024-51645/): WordPress ThemeFuse Maintenance Mode plugin <= 1.1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51644](https://insights.sbomify.com/CVE-2024-51644/): WordPress Addressbook plugin <= 1.1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51643](https://insights.sbomify.com/CVE-2024-51643/): WordPress Amazon Associate Filter plugin <= 0.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51642](https://insights.sbomify.com/CVE-2024-51642/): WordPress Seo Free plugin <= 1.4 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51641](https://insights.sbomify.com/CVE-2024-51641/): WordPress Advanced PDF Generator plugin <= 0.4.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51640](https://insights.sbomify.com/CVE-2024-51640/): WordPress MDR Webmaster Tools plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51639](https://insights.sbomify.com/CVE-2024-51639/): WordPress Naver Blog plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-51638](https://insights.sbomify.com/CVE-2024-51638/): WordPress Awesome Shortcodes For Genesis plugin 1.1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51637](https://insights.sbomify.com/CVE-2024-51637/): WordPress Admin SMS Alert plugin <= 1.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51636](https://insights.sbomify.com/CVE-2024-51636/): WordPress Plugin Name: GMO Social Connection plugin <= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51635](https://insights.sbomify.com/CVE-2024-51635/): WordPress While Loading plugin <= 3.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51634](https://insights.sbomify.com/CVE-2024-51634/): WordPress Webriti Custom Login plugin <= 0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51633](https://insights.sbomify.com/CVE-2024-51633/): WordPress Simple Page Specific Sidebars plugin <= 2.14.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51632](https://insights.sbomify.com/CVE-2024-51632/): WordPress SH Slideshow plugin <= 4.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51631](https://insights.sbomify.com/CVE-2024-51631/): WordPress Sticky Social Bar plugin <= 2.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51630](https://insights.sbomify.com/CVE-2024-51630/): WordPress Responsive Flickr Gallery plugin <= 1.3.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5163](https://insights.sbomify.com/CVE-2024-5163/): Improper permission settings in com.transsion.carlcare (critical 9.8)
- [CVE-2024-51629](https://insights.sbomify.com/CVE-2024-51629/): WordPress Header Footer Composer for Elementor plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51628](https://insights.sbomify.com/CVE-2024-51628/): WordPress EzyOnlineBookings Online Booking System Widget plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51627](https://insights.sbomify.com/CVE-2024-51627/): WordPress Audio Comparison Lite plugin <= 3.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51626](https://insights.sbomify.com/CVE-2024-51626/): WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51625](https://insights.sbomify.com/CVE-2024-51625/): WordPress Quran Shortcode plugin <= 1.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51624](https://insights.sbomify.com/CVE-2024-51624/): WordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51623](https://insights.sbomify.com/CVE-2024-51623/): WordPress WP EIS plugin <= 1.3.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51622](https://insights.sbomify.com/CVE-2024-51622/): WordPress WP EASY RECIPE plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51621](https://insights.sbomify.com/CVE-2024-51621/): WordPress Download-Mirror-Counter plugin <= 1.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51620](https://insights.sbomify.com/CVE-2024-51620/): WordPress Porsline plugin <= 1.0.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-5162](https://insights.sbomify.com/CVE-2024-5162/): WordPress prettyPhoto <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (medium 6.4)
- [CVE-2024-51619](https://insights.sbomify.com/CVE-2024-51619/): WordPress Market 360 Viewer plugin <= 1.01 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51618](https://insights.sbomify.com/CVE-2024-51618/): WordPress Custom Admin Menu plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51617](https://insights.sbomify.com/CVE-2024-51617/): WordPress Clyp plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51616](https://insights.sbomify.com/CVE-2024-51616/): WordPress AwesomePress plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51615](https://insights.sbomify.com/CVE-2024-51615/): WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-51614](https://insights.sbomify.com/CVE-2024-51614/): WordPress Aajoda Testimonials plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51613](https://insights.sbomify.com/CVE-2024-51613/): WordPress TradeMe widgets plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51612](https://insights.sbomify.com/CVE-2024-51612/): WordPress Reftagger Shortcode plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51611](https://insights.sbomify.com/CVE-2024-51611/): WordPress WP Feature Box plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51610](https://insights.sbomify.com/CVE-2024-51610/): WordPress Display Terms Shortcode plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5161](https://insights.sbomify.com/CVE-2024-5161/): Magical Addons For Elementor <= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-51609](https://insights.sbomify.com/CVE-2024-51609/): WordPress Emoji Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51608](https://insights.sbomify.com/CVE-2024-51608/): WordPress AmaDiscount Plugin plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51607](https://insights.sbomify.com/CVE-2024-51607/): WordPress Golf Tracker plugin <= 0.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51606](https://insights.sbomify.com/CVE-2024-51606/): WordPress Blrt WP Embed plugin <= 1.6.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51605](https://insights.sbomify.com/CVE-2024-51605/): WordPress Genoo plugin <= 6.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51604](https://insights.sbomify.com/CVE-2024-51604/): WordPress Media Modal plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/220/