# Vulnerabilities published in 2024


- [CVE-2024-49329](https://insights.sbomify.com/CVE-2024-49329/): WordPress WP REST API FNS plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49328](https://insights.sbomify.com/CVE-2024-49328/): WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-49327](https://insights.sbomify.com/CVE-2024-49327/): WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49326](https://insights.sbomify.com/CVE-2024-49326/): WordPress Affiliator plugin <= 2.1.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49325](https://insights.sbomify.com/CVE-2024-49325/): WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability (medium 4.3)
- [CVE-2024-49324](https://insights.sbomify.com/CVE-2024-49324/): WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49323](https://insights.sbomify.com/CVE-2024-49323/): WordPress All in One Slider plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49322](https://insights.sbomify.com/CVE-2024-49322/): WordPress Job Board Manager for WordPress plugin <= 1.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-49321](https://insights.sbomify.com/CVE-2024-49321/): WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-49320](https://insights.sbomify.com/CVE-2024-49320/): WordPress Encyclopedia / Glossary / Wiki plugin <= 1.7.60 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4932](https://insights.sbomify.com/CVE-2024-4932/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)
- [CVE-2024-49319](https://insights.sbomify.com/CVE-2024-49319/): WordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49318](https://insights.sbomify.com/CVE-2024-49318/): WordPress My Reading Library plugin <= 1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49317](https://insights.sbomify.com/CVE-2024-49317/): WordPress Point Maker plugin <= 0.1.4 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49316](https://insights.sbomify.com/CVE-2024-49316/): WordPress Akismet htaccess writer plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49315](https://insights.sbomify.com/CVE-2024-49315/): WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-49314](https://insights.sbomify.com/CVE-2024-49314/): WordPress JiangQie Free Mini Program plugin <= 2.5.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49313](https://insights.sbomify.com/CVE-2024-49313/): WordPress VKontakte Wall Post plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49312](https://insights.sbomify.com/CVE-2024-49312/): WordPress Edwiser Bridge plugin <= 3.0.7 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-49311](https://insights.sbomify.com/CVE-2024-49311/): WordPress Edwiser Bridge plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49310](https://insights.sbomify.com/CVE-2024-49310/): WordPress Themesflat Addons For Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4931](https://insights.sbomify.com/CVE-2024-4931/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)
- [CVE-2024-49309](https://insights.sbomify.com/CVE-2024-49309/): WordPress Digitally theme <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49308](https://insights.sbomify.com/CVE-2024-49308/): WordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49307](https://insights.sbomify.com/CVE-2024-49307/): WordPress Admin Management Xtended plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49306](https://insights.sbomify.com/CVE-2024-49306/): WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49305](https://insights.sbomify.com/CVE-2024-49305/): WordPress Customer Email Verification for WooCommerce plugin <= 2.8.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-49304](https://insights.sbomify.com/CVE-2024-49304/): WordPress Pinpoint Booking System plugin <= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2024-49303](https://insights.sbomify.com/CVE-2024-49303/): WordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49302](https://insights.sbomify.com/CVE-2024-49302/): WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49301](https://insights.sbomify.com/CVE-2024-49301/): WordPress G Meta Keywords plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49300](https://insights.sbomify.com/CVE-2024-49300/): WordPress Hero Menu plugin <= 1.16.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4930](https://insights.sbomify.com/CVE-2024-4930/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)
- [CVE-2024-49299](https://insights.sbomify.com/CVE-2024-49299/): WordPress Surfer plugin <= 1.5.0.502 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-49298](https://insights.sbomify.com/CVE-2024-49298/): WordPress PeproDev Ultimate Invoice plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49297](https://insights.sbomify.com/CVE-2024-49297/): WordPress Zoho CRM Lead Magnet plugin <= 1.7.9.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49296](https://insights.sbomify.com/CVE-2024-49296/): WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49295](https://insights.sbomify.com/CVE-2024-49295/): WordPress Simple Testimonials Showcase plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-49294](https://insights.sbomify.com/CVE-2024-49294/): WordPress WpBusTicketly plugin <= 5.4.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49293](https://insights.sbomify.com/CVE-2024-49293/): WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-49292](https://insights.sbomify.com/CVE-2024-49292/): WordPress Exclusive Addons for Elementor plugin <= 2.7.1 - Cross-Site Scripting vulnerability (medium 6.5)
- [CVE-2024-49291](https://insights.sbomify.com/CVE-2024-49291/): WordPress Cooked Pro plugin < 1.8.0 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49290](https://insights.sbomify.com/CVE-2024-49290/): WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-4929](https://insights.sbomify.com/CVE-2024-4929/): SourceCodester Simple Online Bidding System cross-site request forgery (medium 6.9)
- [CVE-2024-49289](https://insights.sbomify.com/CVE-2024-49289/): WordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49288](https://insights.sbomify.com/CVE-2024-49288/): WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-49287](https://insights.sbomify.com/CVE-2024-49287/): WordPress PDF-Rechnungsverwaltung plugin <= 0.0.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49286](https://insights.sbomify.com/CVE-2024-49286/): WordPress SSV Events plugin <= 3.2.7 - Local File Inclusion to RCE vulnerability (critical 9.6)
- [CVE-2024-49285](https://insights.sbomify.com/CVE-2024-49285/): WordPress SSV MailChimp plugin <= 3.1.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49284](https://insights.sbomify.com/CVE-2024-49284/): WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-49283](https://insights.sbomify.com/CVE-2024-49283/): WordPress CURCY plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49282](https://insights.sbomify.com/CVE-2024-49282/): WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-49281](https://insights.sbomify.com/CVE-2024-49281/): Cross-site scripting in Click to Chat – WP Support All-in-One Floating Widget (medium 6.5)
- [CVE-2024-49280](https://insights.sbomify.com/CVE-2024-49280/): WordPress Lightbox slider -- Responsive Lightbox Gallery plugin <= 1.10.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4928](https://insights.sbomify.com/CVE-2024-4928/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)
- [CVE-2024-49279](https://insights.sbomify.com/CVE-2024-49279/): WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49278](https://insights.sbomify.com/CVE-2024-49278/): WordPress Omnipress plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49277](https://insights.sbomify.com/CVE-2024-49277/): WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49276](https://insights.sbomify.com/CVE-2024-49276/): WordPress Clio Grow plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49275](https://insights.sbomify.com/CVE-2024-49275/): WordPress IdeaPush plugin <= 8.69 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49274](https://insights.sbomify.com/CVE-2024-49274/): WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-49273](https://insights.sbomify.com/CVE-2024-49273/): WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49272](https://insights.sbomify.com/CVE-2024-49272/): WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-49271](https://insights.sbomify.com/CVE-2024-49271/): Deserialization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (critical 9.1)
- [CVE-2024-49270](https://insights.sbomify.com/CVE-2024-49270/): WordPress Smart Blocks plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4927](https://insights.sbomify.com/CVE-2024-4927/): SourceCodester Simple Online Bidding System unrestricted upload (medium 6.9)
- [CVE-2024-49269](https://insights.sbomify.com/CVE-2024-49269/): WordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49268](https://insights.sbomify.com/CVE-2024-49268/): WordPress disconnected theme <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49267](https://insights.sbomify.com/CVE-2024-49267/): WordPress Unlimited Addon For Elementor plugin <=2.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49266](https://insights.sbomify.com/CVE-2024-49266/): WordPress WP-Spreadplugin plugin <= 4.8.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-49265](https://insights.sbomify.com/CVE-2024-49265/): WordPress Booking.com Banner Creator plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49264](https://insights.sbomify.com/CVE-2024-49264/): WordPress Events Addon for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49263](https://insights.sbomify.com/CVE-2024-49263/): WordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49262](https://insights.sbomify.com/CVE-2024-49262/): WordPress Country Flags for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49261](https://insights.sbomify.com/CVE-2024-49261/): WordPress Arkhe Blocks plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49260](https://insights.sbomify.com/CVE-2024-49260/): WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-4926](https://insights.sbomify.com/CVE-2024-4926/): SourceCodester School Intramurals Student Attendance Management System manage_student.php sql injection (medium 5.3)
- [CVE-2024-49259](https://insights.sbomify.com/CVE-2024-49259/): WordPress Primary Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49258](https://insights.sbomify.com/CVE-2024-49258/): WordPress Limb Gallery plugin <= 1.5.7 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2024-49257](https://insights.sbomify.com/CVE-2024-49257/): WordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49256](https://insights.sbomify.com/CVE-2024-49256/): WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-49255](https://insights.sbomify.com/CVE-2024-49255/): WordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49254](https://insights.sbomify.com/CVE-2024-49254/): WordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2024-49253](https://insights.sbomify.com/CVE-2024-49253/): WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-49252](https://insights.sbomify.com/CVE-2024-49252/): WordPress leyka plugin <=3.31.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-49251](https://insights.sbomify.com/CVE-2024-49251/): WordPress Maan Addons For Elementor plugin <= 1.0.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49250](https://insights.sbomify.com/CVE-2024-49250/): WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-4925](https://insights.sbomify.com/CVE-2024-4925/): SourceCodester School Intramurals Student Attendance Management System manage_course.php sql injection (medium 5.3)
- [CVE-2024-49249](https://insights.sbomify.com/CVE-2024-49249/): WordPress SMSA Shipping plugin <= 2.3 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-49248](https://insights.sbomify.com/CVE-2024-49248/): WordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49247](https://insights.sbomify.com/CVE-2024-49247/): WordPress BuddyPress Better Registration plugin <= 1.6 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-49246](https://insights.sbomify.com/CVE-2024-49246/): WordPress Ajax Rating with Custom Login plugin <= 1.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-49245](https://insights.sbomify.com/CVE-2024-49245/): WordPress Ahime Image Printer plugin <= 1.0.0 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-49244](https://insights.sbomify.com/CVE-2024-49244/): WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49243](https://insights.sbomify.com/CVE-2024-49243/): WordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-49242](https://insights.sbomify.com/CVE-2024-49242/): WordPress Digital Lottery plugin <= 3.0.5 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49241](https://insights.sbomify.com/CVE-2024-49241/): WordPress Tito plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49240](https://insights.sbomify.com/CVE-2024-49240/): WordPress AB Categories Search Widget plugin <= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4924](https://insights.sbomify.com/CVE-2024-4924/): Sassy social share < 3.3.63 Admin+ Stored Cross-Site scripting (medium 6.1)
- [CVE-2024-49239](https://insights.sbomify.com/CVE-2024-49239/): WordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/239/