# Vulnerabilities published in 2024


- [CVE-2024-49706](https://insights.sbomify.com/CVE-2024-49706/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-49705](https://insights.sbomify.com/CVE-2024-49705/): XSS in iKSORIS (medium 5.3)
- [CVE-2024-49704](https://insights.sbomify.com/CVE-2024-49704/): XML external entity in COMOS V10.3 (medium 5.7)
- [CVE-2024-49703](https://insights.sbomify.com/CVE-2024-49703/): WordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49702](https://insights.sbomify.com/CVE-2024-49702/): WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49701](https://insights.sbomify.com/CVE-2024-49701/): WordPress Mags theme <= 1.1.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49700](https://insights.sbomify.com/CVE-2024-49700/): WordPress ARPrice plugin <= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4970](https://insights.sbomify.com/CVE-2024-4970/): Widget Bundle <= 2.0.0 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-49699](https://insights.sbomify.com/CVE-2024-49699/): WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-49698](https://insights.sbomify.com/CVE-2024-49698/): WordPress Great Restaurant Menu WP plugin <= 1.4.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-49697](https://insights.sbomify.com/CVE-2024-49697/): WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-49696](https://insights.sbomify.com/CVE-2024-49696/): Cross-site scripting in Robo Gallery (medium 5.9)
- [CVE-2024-49695](https://insights.sbomify.com/CVE-2024-49695/): WordPress WP Flow Plus plugin <= 5.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49694](https://insights.sbomify.com/CVE-2024-49694/): WordPress My Wp Brand – Hide menu & Hide Plugin plugin <= 1.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-49693](https://insights.sbomify.com/CVE-2024-49693/): WordPress Mega Elements – Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49692](https://insights.sbomify.com/CVE-2024-49692/): WordPress AffiliateX plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49691](https://insights.sbomify.com/CVE-2024-49691/): WordPress Product Filter by WBW plugin <= 2.7.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-49690](https://insights.sbomify.com/CVE-2024-49690/): WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-4969](https://insights.sbomify.com/CVE-2024-4969/): Widget Bundle <= 2.0.0 - Widget Disable/Enable via CSRF (medium 4.3)
- [CVE-2024-49689](https://insights.sbomify.com/CVE-2024-49689/): WordPress HD Quiz – Save Results Light plugin <= 0.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-49688](https://insights.sbomify.com/CVE-2024-49688/): WordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49687](https://insights.sbomify.com/CVE-2024-49687/): WordPress Smart Manager plugin <= 8.45.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-49686](https://insights.sbomify.com/CVE-2024-49686/): WordPress Landing Page Cat plugin <= 1.7.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-49685](https://insights.sbomify.com/CVE-2024-49685/): WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-49684](https://insights.sbomify.com/CVE-2024-49684/): WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2024-49683](https://insights.sbomify.com/CVE-2024-49683/): WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-49682](https://insights.sbomify.com/CVE-2024-49682/): WordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-49681](https://insights.sbomify.com/CVE-2024-49681/): WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-49680](https://insights.sbomify.com/CVE-2024-49680/): WordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-4968](https://insights.sbomify.com/CVE-2024-4968/): SourceCodester Interactive Map with Marker Add Marker Marker Name cross site scripting (medium 5.3)
- [CVE-2024-49679](https://insights.sbomify.com/CVE-2024-49679/): WordPress WPKoi Templates for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-49678](https://insights.sbomify.com/CVE-2024-49678/): WordPress js paper theme <= 2.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49677](https://insights.sbomify.com/CVE-2024-49677/): WordPress Bootstrap Buttons plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49676](https://insights.sbomify.com/CVE-2024-49676/): WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerability (medium 6.6)
- [CVE-2024-49675](https://insights.sbomify.com/CVE-2024-49675/): WordPress iBryl Switch User plugin <= 1.0.1 - Account Takeover vulnerability (high 8.8)
- [CVE-2024-49674](https://insights.sbomify.com/CVE-2024-49674/): WordPress EKC Tournament Manager plugin <= 2.2.1 - CSRF to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2024-49673](https://insights.sbomify.com/CVE-2024-49673/): WordPress LaTeX2HTML plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49672](https://insights.sbomify.com/CVE-2024-49672/): WordPress Google Docs RSVP plugin <= 2.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49671](https://insights.sbomify.com/CVE-2024-49671/): WordPress AI Postpix plugin <= 1.1.8 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49670](https://insights.sbomify.com/CVE-2024-49670/): WordPress Client Power Tools Portal plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4967](https://insights.sbomify.com/CVE-2024-4967/): SourceCodester Interactive Map with Marker delete-mark.php sql injection (medium 5.3)
- [CVE-2024-49669](https://insights.sbomify.com/CVE-2024-49669/): WordPress INK Official plugin <= 4.1.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49668](https://insights.sbomify.com/CVE-2024-49668/): WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49667](https://insights.sbomify.com/CVE-2024-49667/): WordPress Local Business Addons For Elementor plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49666](https://insights.sbomify.com/CVE-2024-49666/): WordPress ARPrice plugin <= 4.1.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49665](https://insights.sbomify.com/CVE-2024-49665/): WordPress Web Bricks Addons for Elementor plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49664](https://insights.sbomify.com/CVE-2024-49664/): WordPress chatplusjp plugin <= 1.02 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49663](https://insights.sbomify.com/CVE-2024-49663/): WordPress uCAT – Next Story plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49662](https://insights.sbomify.com/CVE-2024-49662/): WordPress Simple Load More plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49661](https://insights.sbomify.com/CVE-2024-49661/): WordPress leenk.me plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49660](https://insights.sbomify.com/CVE-2024-49660/): WordPress Campus Explorer Widget plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4966](https://insights.sbomify.com/CVE-2024-4966/): SourceCodester SchoolWebTech home.php unrestricted upload (medium 6.9)
- [CVE-2024-49659](https://insights.sbomify.com/CVE-2024-49659/): WordPress Coub plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49658](https://insights.sbomify.com/CVE-2024-49658/): WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49657](https://insights.sbomify.com/CVE-2024-49657/): WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2024-49656](https://insights.sbomify.com/CVE-2024-49656/): WordPress DocumentPress plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49655](https://insights.sbomify.com/CVE-2024-49655/): WordPress ARPrice plugin <= 4.1.3 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-49654](https://insights.sbomify.com/CVE-2024-49654/): WordPress Extra Privacy for Elementor plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49653](https://insights.sbomify.com/CVE-2024-49653/): WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49652](https://insights.sbomify.com/CVE-2024-49652/): WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49651](https://insights.sbomify.com/CVE-2024-49651/): WordPress WooCommerce Maintenance Mode plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49650](https://insights.sbomify.com/CVE-2024-49650/): WordPress BuddyPress Greeting Message plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4965](https://insights.sbomify.com/CVE-2024-4965/): D-Link DAR-7000-40 resmanage.php os command injection (medium 5.3)
- [CVE-2024-49649](https://insights.sbomify.com/CVE-2024-49649/): WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2024-49648](https://insights.sbomify.com/CVE-2024-49648/): WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49647](https://insights.sbomify.com/CVE-2024-49647/): WordPress Simple Custom Admin plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49646](https://insights.sbomify.com/CVE-2024-49646/): WordPress Code Generate plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49645](https://insights.sbomify.com/CVE-2024-49645/): WordPress Affiliate Platform plugin <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49644](https://insights.sbomify.com/CVE-2024-49644/): WordPress Accessibility by AllAccessible plugin <= 1.3.4 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-49643](https://insights.sbomify.com/CVE-2024-49643/): WordPress Whitelist plugin <= 3.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49642](https://insights.sbomify.com/CVE-2024-49642/): WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49641](https://insights.sbomify.com/CVE-2024-49641/): WordPress Tida URL Screenshot plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49640](https://insights.sbomify.com/CVE-2024-49640/): WordPress ACL Floating Cart for WooCommerce plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4964](https://insights.sbomify.com/CVE-2024-4964/): D-Link DAR-7000-40 urlblist.php unrestricted upload (medium 5.3)
- [CVE-2024-49639](https://insights.sbomify.com/CVE-2024-49639/): WordPress Monitor.chat plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49638](https://insights.sbomify.com/CVE-2024-49638/): WordPress Risk Warning Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49637](https://insights.sbomify.com/CVE-2024-49637/): WordPress Bet WC 2018 Russia plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49636](https://insights.sbomify.com/CVE-2024-49636/): WordPress Agile Video Player Lite plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49635](https://insights.sbomify.com/CVE-2024-49635/): WordPress Banner Slider plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49634](https://insights.sbomify.com/CVE-2024-49634/): WordPress BP Member Type Manager plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49633](https://insights.sbomify.com/CVE-2024-49633/): WordPress DirectoryPress plugin <= 3.6.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49632](https://insights.sbomify.com/CVE-2024-49632/): WordPress CWD 3D Image Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49631](https://insights.sbomify.com/CVE-2024-49631/): WordPress Easy Addons for Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49630](https://insights.sbomify.com/CVE-2024-49630/): WordPress WP Education for Elementor plugin <= 1.2.8 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4963](https://insights.sbomify.com/CVE-2024-4963/): D-Link DAR-7000-40 url.php unrestricted upload (medium 5.3)
- [CVE-2024-49629](https://insights.sbomify.com/CVE-2024-49629/): WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-49628](https://insights.sbomify.com/CVE-2024-49628/): WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49627](https://insights.sbomify.com/CVE-2024-49627/): WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49626](https://insights.sbomify.com/CVE-2024-49626/): WordPress Shipyaari Shipping Management plugin <= 1.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49625](https://insights.sbomify.com/CVE-2024-49625/): WordPress SiteBuilder Dynamic Components plugin <= 1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49624](https://insights.sbomify.com/CVE-2024-49624/): WordPress Advanced Advertising System plugin <= 1.3.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49623](https://insights.sbomify.com/CVE-2024-49623/): WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49622](https://insights.sbomify.com/CVE-2024-49622/): WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability (high 8.2)
- [CVE-2024-49621](https://insights.sbomify.com/CVE-2024-49621/): WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability (high 8.2)
- [CVE-2024-49620](https://insights.sbomify.com/CVE-2024-49620/): WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-4962](https://insights.sbomify.com/CVE-2024-4962/): D-Link DAR-7000-40 resmanage.php unrestricted upload (medium 5.3)
- [CVE-2024-49619](https://insights.sbomify.com/CVE-2024-49619/): WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49618](https://insights.sbomify.com/CVE-2024-49618/): WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49617](https://insights.sbomify.com/CVE-2024-49617/): WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability (high 8.2)
- [CVE-2024-49616](https://insights.sbomify.com/CVE-2024-49616/): WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerability (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/236/