# Vulnerabilities published in 2024


- [CVE-2024-47381](https://insights.sbomify.com/CVE-2024-47381/): WordPress Slider & Popup Builder by Depicter plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47380](https://insights.sbomify.com/CVE-2024-47380/): WordPress WP-Lister Lite for eBay plugin <= 3.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4738](https://insights.sbomify.com/CVE-2024-4738/): Campcodes Legal Case Management System cross site scripting (medium 5.3)
- [CVE-2024-47379](https://insights.sbomify.com/CVE-2024-47379/): WordPress Web Directory Free plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47378](https://insights.sbomify.com/CVE-2024-47378/): WordPress WPCOM Member plugin <= 1.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47377](https://insights.sbomify.com/CVE-2024-47377/): WordPress BuddyForms plugin <= 2.8.12 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47376](https://insights.sbomify.com/CVE-2024-47376/): WordPress Slideshow Gallery LITE plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47375](https://insights.sbomify.com/CVE-2024-47375/): Cross-site scripting in XLTab – Accordions and Tabs for Elementor Page Builder (medium 6.5)
- [CVE-2024-47374](https://insights.sbomify.com/CVE-2024-47374/): WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47373](https://insights.sbomify.com/CVE-2024-47373/): WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47372](https://insights.sbomify.com/CVE-2024-47372/): WordPress TNC PDF viewer plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47371](https://insights.sbomify.com/CVE-2024-47371/): WordPress WP MyLinks plugin<= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47370](https://insights.sbomify.com/CVE-2024-47370/): WordPress Author Avatars List/Block plugin <= 2.1.21 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4737](https://insights.sbomify.com/CVE-2024-4737/): Campcodes Legal Case Management System vendor cross site scripting (medium 5.3)
- [CVE-2024-47369](https://insights.sbomify.com/CVE-2024-47369/): WordPress Social Auto Poster plugin <= 5.3.15 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47368](https://insights.sbomify.com/CVE-2024-47368/): WordPress Premium Blocks plugin <= 2.1.33 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47367](https://insights.sbomify.com/CVE-2024-47367/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.13.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47366](https://insights.sbomify.com/CVE-2024-47366/): WordPress Elementor Addon Elements plugin <= 1.13.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47365](https://insights.sbomify.com/CVE-2024-47365/): WordPress Automatically Hierarchic Categories in Menu plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47364](https://insights.sbomify.com/CVE-2024-47364/): WordPress Move Addons for Elementor plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47363](https://insights.sbomify.com/CVE-2024-47363/): WordPress Blockspare plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47362](https://insights.sbomify.com/CVE-2024-47362/): WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-47361](https://insights.sbomify.com/CVE-2024-47361/): WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-47360](https://insights.sbomify.com/CVE-2024-47360/): WordPress BA Book Everything plugin <= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4736](https://insights.sbomify.com/CVE-2024-4736/): Campcodes Legal Case Management System tax cross site scripting (medium 5.3)
- [CVE-2024-47359](https://insights.sbomify.com/CVE-2024-47359/): WordPress Depicter plugin <= 3.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-47358](https://insights.sbomify.com/CVE-2024-47358/): WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-47357](https://insights.sbomify.com/CVE-2024-47357/): WordPress Happy Addons for Elementor plugin <= 3.12.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47356](https://insights.sbomify.com/CVE-2024-47356/): WordPress Create theme <= 2.9.1 - Cross Site Scripting (XSS) vulnerability (medium 5.1)
- [CVE-2024-47355](https://insights.sbomify.com/CVE-2024-47355/): WordPress Cozy Blocks plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47354](https://insights.sbomify.com/CVE-2024-47354/): WordPress Simple Membership After Login Redirection plugin <= 1.6 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-47353](https://insights.sbomify.com/CVE-2024-47353/): WordPress ElementsReady Addons for Elementor plugin <= 6.4.2 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-47352](https://insights.sbomify.com/CVE-2024-47352/): WordPress WP Bulk Delete plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47351](https://insights.sbomify.com/CVE-2024-47351/): WordPress MaxSlider plugin <= 1.2.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-47350](https://insights.sbomify.com/CVE-2024-47350/): WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-4735](https://insights.sbomify.com/CVE-2024-4735/): Campcodes Legal Case Management System tasks cross site scripting (medium 5.3)
- [CVE-2024-47349](https://insights.sbomify.com/CVE-2024-47349/): WordPress WPMobile.App plugin <= 11.50 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47348](https://insights.sbomify.com/CVE-2024-47348/): WordPress Visual CSS Style Editor plugin <= 7.6.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47347](https://insights.sbomify.com/CVE-2024-47347/): WordPress Chartify plugin <= 2.7.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47346](https://insights.sbomify.com/CVE-2024-47346/): WordPress Newsletters plugin <= 4.9.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47345](https://insights.sbomify.com/CVE-2024-47345/): WordPress Starter Templates plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47344](https://insights.sbomify.com/CVE-2024-47344/): WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-47343](https://insights.sbomify.com/CVE-2024-47343/): WordPress Mega Elements – Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47342](https://insights.sbomify.com/CVE-2024-47342/): WordPress Accordion plugin <= 2.2.99 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47341](https://insights.sbomify.com/CVE-2024-47341/): WordPress WP-DownloadManager plugin <= 1.68.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47340](https://insights.sbomify.com/CVE-2024-47340/): WordPress ComboBlocks plugin <= 2.2.89 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4734](https://insights.sbomify.com/CVE-2024-4734/): Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-47339](https://insights.sbomify.com/CVE-2024-47339/): WordPress WP Mail Catcher plugin <= 2.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47338](https://insights.sbomify.com/CVE-2024-47338/): WordPress WPExperts Square For GiveWP plugin <= 1.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-47337](https://insights.sbomify.com/CVE-2024-47337/): WordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-47336](https://insights.sbomify.com/CVE-2024-47336/): WordPress Terms Descriptions plugin <= 3.4.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47335](https://insights.sbomify.com/CVE-2024-47335/): WordPress Bit Form plugin <= 2.13.11 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-47334](https://insights.sbomify.com/CVE-2024-47334/): WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-47333](https://insights.sbomify.com/CVE-2024-47333/): WordPress Loops & Logic plugin <= 4.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47332](https://insights.sbomify.com/CVE-2024-47332/): WordPress Sky Addons for Elementor plugin <= 2.5.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47331](https://insights.sbomify.com/CVE-2024-47331/): WordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-47330](https://insights.sbomify.com/CVE-2024-47330/): Broken Access Control vulnerability on multiple WordPress plugins by Supsystic (medium 4.3)
- [CVE-2024-4733](https://insights.sbomify.com/CVE-2024-4733/): ShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection (high 7.5)
- [CVE-2024-47329](https://insights.sbomify.com/CVE-2024-47329/): WordPress ElementsReady Addons for Elementor plugin <= 6.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47328](https://insights.sbomify.com/CVE-2024-47328/): SQL injection in FunnelKit Automations (high 7.6)
- [CVE-2024-47327](https://insights.sbomify.com/CVE-2024-47327/): WordPress GEO my WP plugin <= 4.5.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47326](https://insights.sbomify.com/CVE-2024-47326/): WordPress Share This Image plugin <= 2.01 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47325](https://insights.sbomify.com/CVE-2024-47325/): WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-47324](https://insights.sbomify.com/CVE-2024-47324/): WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-47323](https://insights.sbomify.com/CVE-2024-47323/): WordPress WP Timeline plugin <= 3.6.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-47322](https://insights.sbomify.com/CVE-2024-47322/): WordPress WP Timeline plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47321](https://insights.sbomify.com/CVE-2024-47321/): WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-47320](https://insights.sbomify.com/CVE-2024-47320/): WordPress WS Form LITE plugin <= 1.9.238 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4732](https://insights.sbomify.com/CVE-2024-4732/): Campcodes Legal Case Management System service cross site scripting (medium 5.3)
- [CVE-2024-47319](https://insights.sbomify.com/CVE-2024-47319/): WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability (high 8.0)
- [CVE-2024-47318](https://insights.sbomify.com/CVE-2024-47318/): WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-47317](https://insights.sbomify.com/CVE-2024-47317/): WordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-47316](https://insights.sbomify.com/CVE-2024-47316/): WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-47315](https://insights.sbomify.com/CVE-2024-47315/): Cross-site request forgery in GiveWP (medium 5.4)
- [CVE-2024-47314](https://insights.sbomify.com/CVE-2024-47314/): WordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-47313](https://insights.sbomify.com/CVE-2024-47313/): WordPress Catch Base theme <= 3.4.6 - Cross Site Scripting (XSS) vulnerability (medium 5.1)
- [CVE-2024-47312](https://insights.sbomify.com/CVE-2024-47312/): WordPress Classic Editor and Classic Widgets plugin <= 1.4.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-47311](https://insights.sbomify.com/CVE-2024-47311/): WordPress Wheel of Life plugin <= 1.1.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-47310](https://insights.sbomify.com/CVE-2024-47310/): WordPress ARI Fancy Lightbox -- Popup for WordPress plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4731](https://insights.sbomify.com/CVE-2024-4731/): Campcodes Legal Case Management System role cross site scripting (medium 5.3)
- [CVE-2024-47309](https://insights.sbomify.com/CVE-2024-47309/): WordPress Cities Shipping Zones for WooCommerce plugin <= 1.2.7 - Local File Inclusion vulnerability (medium 6.6)
- [CVE-2024-47308](https://insights.sbomify.com/CVE-2024-47308/): WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-47307](https://insights.sbomify.com/CVE-2024-47307/): WordPress Meta Slider and Carousel with Lightbox plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47306](https://insights.sbomify.com/CVE-2024-47306/): WordPress Secure Copy Content Protection and Content Locking plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47305](https://insights.sbomify.com/CVE-2024-47305/): WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-47304](https://insights.sbomify.com/CVE-2024-47304/): WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-47303](https://insights.sbomify.com/CVE-2024-47303/): WordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47302](https://insights.sbomify.com/CVE-2024-47302/): WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability (medium 5.3)
- [CVE-2024-47301](https://insights.sbomify.com/CVE-2024-47301/): WordPress Bit Form plugin <= 2.13.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47300](https://insights.sbomify.com/CVE-2024-47300/): WordPress CubeWP Forms plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4730](https://insights.sbomify.com/CVE-2024-4730/): Campcodes Legal Case Management System judge cross site scripting (medium 5.3)
- [CVE-2024-47299](https://insights.sbomify.com/CVE-2024-47299/): WordPress Website Builder by SeedProd <= 6.17.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47298](https://insights.sbomify.com/CVE-2024-47298/): WordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47297](https://insights.sbomify.com/CVE-2024-47297/): WordPress Polls CP plugin <= 1.0.74 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47295](https://insights.sbomify.com/CVE-2024-47295/): Auth bypass in Web Config (high 8.1)
- [CVE-2024-47294](https://insights.sbomify.com/CVE-2024-47294/): Missing authorization in EMUI (medium 4.4)
- [CVE-2024-47293](https://insights.sbomify.com/CVE-2024-47293/): Memory corruption in EMUI (medium 4.7)
- [CVE-2024-47292](https://insights.sbomify.com/CVE-2024-47292/): Path traversal in EMUI (medium 6.2)
- [CVE-2024-47291](https://insights.sbomify.com/CVE-2024-47291/): Missing authorization in EMUI (medium 5.6)
- [CVE-2024-47290](https://insights.sbomify.com/CVE-2024-47290/): Null dereference in EMUI (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/253/