# Vulnerabilities published in 2024


- [CVE-2024-50489](https://insights.sbomify.com/CVE-2024-50489/): WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-50488](https://insights.sbomify.com/CVE-2024-50488/): WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability (high 8.8)
- [CVE-2024-50487](https://insights.sbomify.com/CVE-2024-50487/): WordPress MaanStore API plugin <= 1.0.1 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-50486](https://insights.sbomify.com/CVE-2024-50486/): WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-50485](https://insights.sbomify.com/CVE-2024-50485/): WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-50484](https://insights.sbomify.com/CVE-2024-50484/): WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50483](https://insights.sbomify.com/CVE-2024-50483/): WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-50482](https://insights.sbomify.com/CVE-2024-50482/): WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50481](https://insights.sbomify.com/CVE-2024-50481/): WordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-50480](https://insights.sbomify.com/CVE-2024-50480/): WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-5048](https://insights.sbomify.com/CVE-2024-5048/): code-projects Budget Management index.php sql injection (medium 5.3)
- [CVE-2024-50479](https://insights.sbomify.com/CVE-2024-50479/): WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-50478](https://insights.sbomify.com/CVE-2024-50478/): WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-50477](https://insights.sbomify.com/CVE-2024-50477/): WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-50476](https://insights.sbomify.com/CVE-2024-50476/): WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-50475](https://insights.sbomify.com/CVE-2024-50475/): WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-50473](https://insights.sbomify.com/CVE-2024-50473/): WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-50472](https://insights.sbomify.com/CVE-2024-50472/): WordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50471](https://insights.sbomify.com/CVE-2024-50471/): WordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50470](https://insights.sbomify.com/CVE-2024-50470/): WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5047](https://insights.sbomify.com/CVE-2024-5047/): SourceCodester Student Management System controller.php unrestricted upload (medium 6.9)
- [CVE-2024-50469](https://insights.sbomify.com/CVE-2024-50469/): WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50468](https://insights.sbomify.com/CVE-2024-50468/): WordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50467](https://insights.sbomify.com/CVE-2024-50467/): WordPress Scrollbar by webxapp plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50466](https://insights.sbomify.com/CVE-2024-50466/): Cross-site request forgery in DarkMySite – Advanced Dark Mode Plugin for WordPress (medium 4.3)
- [CVE-2024-50465](https://insights.sbomify.com/CVE-2024-50465/): WordPress Premium SEO Pack plugin <= 1.6.001 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-50464](https://insights.sbomify.com/CVE-2024-50464/): WordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50463](https://insights.sbomify.com/CVE-2024-50463/): WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-50462](https://insights.sbomify.com/CVE-2024-50462/): WordPress Interactive World Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50461](https://insights.sbomify.com/CVE-2024-50461/): WordPress EmbedPress plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50460](https://insights.sbomify.com/CVE-2024-50460/): WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-5046](https://insights.sbomify.com/CVE-2024-5046/): SourceCodester Online Examination System registeracc.php sql injection (medium 6.9)
- [CVE-2024-50459](https://insights.sbomify.com/CVE-2024-50459/): WordPress AidWP plugin <= 3.2.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-50458](https://insights.sbomify.com/CVE-2024-50458/): WordPress Advanced Sermons plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50457](https://insights.sbomify.com/CVE-2024-50457/): WordPress Qode Essential Addons plugin <= 1.6.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-50456](https://insights.sbomify.com/CVE-2024-50456/): WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-50455](https://insights.sbomify.com/CVE-2024-50455/): WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-50454](https://insights.sbomify.com/CVE-2024-50454/): WordPress SEOPress plugin <= 8.1.1 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-50453](https://insights.sbomify.com/CVE-2024-50453/): WordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-50452](https://insights.sbomify.com/CVE-2024-50452/): WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50451](https://insights.sbomify.com/CVE-2024-50451/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50450](https://insights.sbomify.com/CVE-2024-50450/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability (high 7.3)
- [CVE-2024-5045](https://insights.sbomify.com/CVE-2024-5045/): SourceCodester Online Birth Certificate Management System admin file access (medium 6.9)
- [CVE-2024-50449](https://insights.sbomify.com/CVE-2024-50449/): WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50448](https://insights.sbomify.com/CVE-2024-50448/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50447](https://insights.sbomify.com/CVE-2024-50447/): Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce (medium 6.5)
- [CVE-2024-50446](https://insights.sbomify.com/CVE-2024-50446/): WordPress Futurio Extra plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50445](https://insights.sbomify.com/CVE-2024-50445/): WordPress Selection Lite plugin <= 1.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50443](https://insights.sbomify.com/CVE-2024-50443/): WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50442](https://insights.sbomify.com/CVE-2024-50442/): WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability (medium 6.5)
- [CVE-2024-50441](https://insights.sbomify.com/CVE-2024-50441/): WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50440](https://insights.sbomify.com/CVE-2024-50440/): WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5044](https://insights.sbomify.com/CVE-2024-5044/): Emlog Pro Cookie improper authentication (medium 6.3)
- [CVE-2024-50439](https://insights.sbomify.com/CVE-2024-50439/): WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50438](https://insights.sbomify.com/CVE-2024-50438/): WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50437](https://insights.sbomify.com/CVE-2024-50437/): WordPress GeoDirectory plugin <= 2.3.80 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50436](https://insights.sbomify.com/CVE-2024-50436/): WordPress Clean Retina theme <= 3.0.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-50435](https://insights.sbomify.com/CVE-2024-50435/): WordPress Meta News theme <= 1.1.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-50434](https://insights.sbomify.com/CVE-2024-50434/): WordPress NewsCard theme <= 1.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-50433](https://insights.sbomify.com/CVE-2024-50433/): WordPress Sky Addons for Elementor plugin <= 2.5.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50432](https://insights.sbomify.com/CVE-2024-50432/): WordPress Post Grid and Gutenberg Blocks plugin <= 2.2.93 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50431](https://insights.sbomify.com/CVE-2024-50431/): WordPress Breeze plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50430](https://insights.sbomify.com/CVE-2024-50430/): WordPress Beaver Builder plugin <= 2.8.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5043](https://insights.sbomify.com/CVE-2024-5043/): Emlog Pro setting.php unrestricted upload (medium 5.1)
- [CVE-2024-50429](https://insights.sbomify.com/CVE-2024-50429/): WordPress Magazine Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50428](https://insights.sbomify.com/CVE-2024-50428/): WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-50427](https://insights.sbomify.com/CVE-2024-50427/): WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-50426](https://insights.sbomify.com/CVE-2024-50426/): WordPress Survey Maker plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50425](https://insights.sbomify.com/CVE-2024-50425/): WordPress WP Booking System – Booking Calendar plugin <= 2.0.19.10 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-50424](https://insights.sbomify.com/CVE-2024-50424/): WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-50423](https://insights.sbomify.com/CVE-2024-50423/): WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-50422](https://insights.sbomify.com/CVE-2024-50422/): WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-50421](https://insights.sbomify.com/CVE-2024-50421/): WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-50420](https://insights.sbomify.com/CVE-2024-50420/): WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-5042](https://insights.sbomify.com/CVE-2024-5042/): Submariner-operator: rbac permissions can allow for the spread of node compromises (medium 6.6)
- [CVE-2024-50419](https://insights.sbomify.com/CVE-2024-50419/): WordPress Greenshift plugin <=9.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-50418](https://insights.sbomify.com/CVE-2024-50418/): WordPress Time Slot plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50417](https://insights.sbomify.com/CVE-2024-50417/): WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-50416](https://insights.sbomify.com/CVE-2024-50416/): WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-50415](https://insights.sbomify.com/CVE-2024-50415/): Cross-site scripting in Ads.txt & App-ads.txt Manager for WordPress (medium 5.9)
- [CVE-2024-50414](https://insights.sbomify.com/CVE-2024-50414/): WordPress Button contact VR plugin <= 4.7.9.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50413](https://insights.sbomify.com/CVE-2024-50413/): WordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50412](https://insights.sbomify.com/CVE-2024-50412/): WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50411](https://insights.sbomify.com/CVE-2024-50411/): WordPress WP Abstracts plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-50410](https://insights.sbomify.com/CVE-2024-50410/): WordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5041](https://insights.sbomify.com/CVE-2024-5041/): Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion (medium 6.4)
- [CVE-2024-50409](https://insights.sbomify.com/CVE-2024-50409/): WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-50408](https://insights.sbomify.com/CVE-2024-50408/): WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-50407](https://insights.sbomify.com/CVE-2024-50407/): WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-50406](https://insights.sbomify.com/CVE-2024-50406/): License Center (low 2.0)
- [CVE-2024-50405](https://insights.sbomify.com/CVE-2024-50405/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-50404](https://insights.sbomify.com/CVE-2024-50404/): Qsync Central (medium 6.8)
- [CVE-2024-50403](https://insights.sbomify.com/CVE-2024-50403/): QTS, QuTS hero (low 2.1)
- [CVE-2024-50402](https://insights.sbomify.com/CVE-2024-50402/): QTS, QuTS hero (low 2.1)
- [CVE-2024-50401](https://insights.sbomify.com/CVE-2024-50401/): QTS, QuTS hero (low 2.1)
- [CVE-2024-50400](https://insights.sbomify.com/CVE-2024-50400/): QTS, QuTS hero (low 2.1)
- [CVE-2024-5040](https://insights.sbomify.com/CVE-2024-5040/): LCDS LAquis SCADA Path Traversal (high 8.5)
- [CVE-2024-50399](https://insights.sbomify.com/CVE-2024-50399/): QTS, QuTS hero (low 2.1)
- [CVE-2024-50398](https://insights.sbomify.com/CVE-2024-50398/): QTS, QuTS hero (low 2.1)
- [CVE-2024-50397](https://insights.sbomify.com/CVE-2024-50397/): QTS, QuTS hero (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/228/