# Vulnerabilities published in 2024


- [CVE-2024-50582](https://insights.sbomify.com/CVE-2024-50582/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50581](https://insights.sbomify.com/CVE-2024-50581/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50580](https://insights.sbomify.com/CVE-2024-50580/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-5058](https://insights.sbomify.com/CVE-2024-5058/): WordPress Typing Text plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50579](https://insights.sbomify.com/CVE-2024-50579/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50578](https://insights.sbomify.com/CVE-2024-50578/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50577](https://insights.sbomify.com/CVE-2024-50577/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50576](https://insights.sbomify.com/CVE-2024-50576/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50575](https://insights.sbomify.com/CVE-2024-50575/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-50574](https://insights.sbomify.com/CVE-2024-50574/): Denial of service in YouTrack (medium 5.3)
- [CVE-2024-50573](https://insights.sbomify.com/CVE-2024-50573/): Missing authorization in Hub (medium 4.3)
- [CVE-2024-50572](https://insights.sbomify.com/CVE-2024-50572/): Command injection in RUGGEDCOM RM1224 LTE(4G) EU (high 8.6)
- [CVE-2024-50571](https://insights.sbomify.com/CVE-2024-50571/): Memory corruption in FortiAnalyzer (medium 6.5)
- [CVE-2024-50570](https://insights.sbomify.com/CVE-2024-50570/): Information disclosure in FortiClientLinux (medium 4.9)
- [CVE-2024-5057](https://insights.sbomify.com/CVE-2024-5057/): WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-50569](https://insights.sbomify.com/CVE-2024-50569/): Command injection in FortiWeb (medium 6.3)
- [CVE-2024-50568](https://insights.sbomify.com/CVE-2024-50568/): Auth bypass in FortiOS (medium 5.6)
- [CVE-2024-50567](https://insights.sbomify.com/CVE-2024-50567/): Command injection in FortiWeb (medium 6.8)
- [CVE-2024-50566](https://insights.sbomify.com/CVE-2024-50566/): Command injection in FortiManager (high 7.2)
- [CVE-2024-50565](https://insights.sbomify.com/CVE-2024-50565/): Auth bypass in FortiAnalyzer (low 3.0)
- [CVE-2024-50564](https://insights.sbomify.com/CVE-2024-50564/): Hardcoded credentials in FortiClientWindows (low 3.2)
- [CVE-2024-50563](https://insights.sbomify.com/CVE-2024-50563/): Auth bypass in FortiAnalyzer (medium 6.7)
- [CVE-2024-50562](https://insights.sbomify.com/CVE-2024-50562/): Auth bypass in FortiOS (medium 4.4)
- [CVE-2024-50561](https://insights.sbomify.com/CVE-2024-50561/): Cross-site scripting in RUGGEDCOM RM1224 LTE(4G) EU (medium 5.1)
- [CVE-2024-50560](https://insights.sbomify.com/CVE-2024-50560/): Other in RUGGEDCOM RM1224 LTE(4G) EU (low 2.3)
- [CVE-2024-5056](https://insights.sbomify.com/CVE-2024-5056/): Information disclosure in Modicon M340 (medium 6.5)
- [CVE-2024-50559](https://insights.sbomify.com/CVE-2024-50559/): Path traversal in RUGGEDCOM RM1224 LTE(4G) EU (medium 5.1)
- [CVE-2024-50558](https://insights.sbomify.com/CVE-2024-50558/): Missing authorization in RUGGEDCOM RM1224 LTE(4G) EU (medium 5.3)
- [CVE-2024-50557](https://insights.sbomify.com/CVE-2024-50557/): Code injection in RUGGEDCOM RM1224 LTE(4G) EU (high 8.6)
- [CVE-2024-50556](https://insights.sbomify.com/CVE-2024-50556/): WordPress WM Zoom plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50555](https://insights.sbomify.com/CVE-2024-50555/): WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50554](https://insights.sbomify.com/CVE-2024-50554/): WordPress Sided plugin <= 1.4.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50553](https://insights.sbomify.com/CVE-2024-50553/): WordPress Classy Addons for Elementor plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50552](https://insights.sbomify.com/CVE-2024-50552/): WordPress Hover Video Preview plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50551](https://insights.sbomify.com/CVE-2024-50551/): WordPress EndomondoWP plugin <= 0.1.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50550](https://insights.sbomify.com/CVE-2024-50550/): WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2024-5055](https://insights.sbomify.com/CVE-2024-5055/): Vulnerability of uncontrolled resource consumption in XAMPP (high 7.5)
- [CVE-2024-50549](https://insights.sbomify.com/CVE-2024-50549/): WordPress Bonway Static Block Editor plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50548](https://insights.sbomify.com/CVE-2024-50548/): WordPress Awesome Progress Bar plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50547](https://insights.sbomify.com/CVE-2024-50547/): WordPress Themedy Toolbox plugin <= 1.0.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50546](https://insights.sbomify.com/CVE-2024-50546/): WordPress MyOrderDesk plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50545](https://insights.sbomify.com/CVE-2024-50545/): WordPress DataMentor plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50544](https://insights.sbomify.com/CVE-2024-50544/): WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-50543](https://insights.sbomify.com/CVE-2024-50543/): WordPress amazing neo icon font for elementor plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50542](https://insights.sbomify.com/CVE-2024-50542/): WordPress RLM Elementor Widgets Pack plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50541](https://insights.sbomify.com/CVE-2024-50541/): WordPress Advanced Control Manager plugin <= 2.16.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50540](https://insights.sbomify.com/CVE-2024-50540/): WordPress (dp) AddThis plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50539](https://insights.sbomify.com/CVE-2024-50539/): WordPress Lodgix.com Vacation Rental Website Builder plugin <= 3.9.73 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-50538](https://insights.sbomify.com/CVE-2024-50538/): WordPress Show Visitor IP Address plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50537](https://insights.sbomify.com/CVE-2024-50537/): WordPress Smart Mockups plugin <= 1.2.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50536](https://insights.sbomify.com/CVE-2024-50536/): WordPress GDReseller plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50535](https://insights.sbomify.com/CVE-2024-50535/): WordPress Step by Step plugin <= 0.4.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50534](https://insights.sbomify.com/CVE-2024-50534/): WordPress World Prayer Time plugin <= 2.0 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50533](https://insights.sbomify.com/CVE-2024-50533/): WordPress Domain Sharding plugin <= 1.2.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50532](https://insights.sbomify.com/CVE-2024-50532/): WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50531](https://insights.sbomify.com/CVE-2024-50531/): WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50530](https://insights.sbomify.com/CVE-2024-50530/): WordPress Stars SMTP Mailer plugin <= 2.2.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-5053](https://insights.sbomify.com/CVE-2024-5053/): Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 4.2)
- [CVE-2024-50529](https://insights.sbomify.com/CVE-2024-50529/): WordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-50528](https://insights.sbomify.com/CVE-2024-50528/): WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-50527](https://insights.sbomify.com/CVE-2024-50527/): WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50526](https://insights.sbomify.com/CVE-2024-50526/): WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50525](https://insights.sbomify.com/CVE-2024-50525/): WordPress Helloprint plugin <= 2.0.4 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50524](https://insights.sbomify.com/CVE-2024-50524/): WordPress Administrator Z plugin < 2024.10.21 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-50523](https://insights.sbomify.com/CVE-2024-50523/): WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50522](https://insights.sbomify.com/CVE-2024-50522/): WordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50521](https://insights.sbomify.com/CVE-2024-50521/): WordPress Alley Elementor Widget plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50520](https://insights.sbomify.com/CVE-2024-50520/): WordPress Ancient World Linked Data plugin <= 0.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5052](https://insights.sbomify.com/CVE-2024-5052/): Resource consumption vulnerability in Cerberus FTP Enterprise (high 7.5)
- [CVE-2024-50519](https://insights.sbomify.com/CVE-2024-50519/): WordPress Jigoshop – Store Exporter plugin <= 1.5.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50518](https://insights.sbomify.com/CVE-2024-50518/): WordPress Pricer Ninja plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50517](https://insights.sbomify.com/CVE-2024-50517/): WordPress ID-SK Toolkit plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50516](https://insights.sbomify.com/CVE-2024-50516/): WordPress Countdown & Clock plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50515](https://insights.sbomify.com/CVE-2024-50515/): Cross-site scripting in Ninja Forms (medium 5.9)
- [CVE-2024-50514](https://insights.sbomify.com/CVE-2024-50514/): Cross-site scripting in Ninja Forms (medium 5.9)
- [CVE-2024-50513](https://insights.sbomify.com/CVE-2024-50513/): WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50512](https://insights.sbomify.com/CVE-2024-50512/): WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerability (medium 5.3)
- [CVE-2024-50511](https://insights.sbomify.com/CVE-2024-50511/): WordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-50510](https://insights.sbomify.com/CVE-2024-50510/): WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-5051](https://insights.sbomify.com/CVE-2024-5051/): SourceCodester Gas Agency Management System edituser.php sql injection (medium 5.3)
- [CVE-2024-50509](https://insights.sbomify.com/CVE-2024-50509/): WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-50508](https://insights.sbomify.com/CVE-2024-50508/): WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-50507](https://insights.sbomify.com/CVE-2024-50507/): WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-50506](https://insights.sbomify.com/CVE-2024-50506/): WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-50504](https://insights.sbomify.com/CVE-2024-50504/): WordPress Bulk Change Role plugin <= 1.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-50503](https://insights.sbomify.com/CVE-2024-50503/): WordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-50502](https://insights.sbomify.com/CVE-2024-50502/): WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50501](https://insights.sbomify.com/CVE-2024-50501/): WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50500](https://insights.sbomify.com/CVE-2024-50500/): WordPress Phlox Core Elements plugin <= 2.17.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-5050](https://insights.sbomify.com/CVE-2024-5050/): Wangshen SecGate 3600 ?g=log_import_save unrestricted upload (medium 5.3)
- [CVE-2024-50498](https://insights.sbomify.com/CVE-2024-50498/): WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2024-50497](https://insights.sbomify.com/CVE-2024-50497/): WordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-50496](https://insights.sbomify.com/CVE-2024-50496/): WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50495](https://insights.sbomify.com/CVE-2024-50495/): WordPress Plugin Propagator plugin <= 0.1 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50494](https://insights.sbomify.com/CVE-2024-50494/): WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50493](https://insights.sbomify.com/CVE-2024-50493/): WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50492](https://insights.sbomify.com/CVE-2024-50492/): WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability (high 8.3)
- [CVE-2024-50491](https://insights.sbomify.com/CVE-2024-50491/): WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-50490](https://insights.sbomify.com/CVE-2024-50490/): WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-5049](https://insights.sbomify.com/CVE-2024-5049/): Codezips E-Commerce Site editproduct.php unrestricted upload (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/227/