# Vulnerabilities published in 2024


- [CVE-2024-44024](https://insights.sbomify.com/CVE-2024-44024/): WordPress Medical Addon for Elementor plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44023](https://insights.sbomify.com/CVE-2024-44023/): WordPress ABCApp Creator plugin <= 1.1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-44022](https://insights.sbomify.com/CVE-2024-44022/): WordPress Review & testimonial widgets plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44021](https://insights.sbomify.com/CVE-2024-44021/): WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-44020](https://insights.sbomify.com/CVE-2024-44020/): WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-44019](https://insights.sbomify.com/CVE-2024-44019/): WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability (medium 5.3)
- [CVE-2024-44018](https://insights.sbomify.com/CVE-2024-44018/): WordPress Instant Chat WP plugin <= 1.0.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44017](https://insights.sbomify.com/CVE-2024-44017/): WordPress MH Board plugin <= 1.3.2.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44016](https://insights.sbomify.com/CVE-2024-44016/): WordPress Podiant plugin <= 1.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44015](https://insights.sbomify.com/CVE-2024-44015/): WordPress Users Control plugin <= 1.0.16 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44014](https://insights.sbomify.com/CVE-2024-44014/): WordPress Vmax Project Manager plugin <= 1.0 - Local File Inclusion to RCE vulnerability (critical 9.6)
- [CVE-2024-44013](https://insights.sbomify.com/CVE-2024-44013/): WordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44012](https://insights.sbomify.com/CVE-2024-44012/): WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44011](https://insights.sbomify.com/CVE-2024-44011/): WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44010](https://insights.sbomify.com/CVE-2024-44010/): WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability (medium 5.1)
- [CVE-2024-4401](https://insights.sbomify.com/CVE-2024-4401/): Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements) (medium 6.4)
- [CVE-2024-44009](https://insights.sbomify.com/CVE-2024-44009/): WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44008](https://insights.sbomify.com/CVE-2024-44008/): WordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44007](https://insights.sbomify.com/CVE-2024-44007/): Cross-site scripting in SKT Templates – Elementor & Gutenberg templates (high 7.1)
- [CVE-2024-44006](https://insights.sbomify.com/CVE-2024-44006/): WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-44005](https://insights.sbomify.com/CVE-2024-44005/): WordPress Greenshift plugin <= 9.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44004](https://insights.sbomify.com/CVE-2024-44004/): WordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-44003](https://insights.sbomify.com/CVE-2024-44003/): WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44002](https://insights.sbomify.com/CVE-2024-44002/): WordPress Team Showcase plugin <= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44001](https://insights.sbomify.com/CVE-2024-44001/): WordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44000](https://insights.sbomify.com/CVE-2024-44000/): WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability (critical 9.8)
- [CVE-2024-4400](https://insights.sbomify.com/CVE-2024-4400/): Cross-site scripting in Post and Page Builder by BoldGrid – Visual Drag and Drop Editor (medium 6.4)
- [CVE-2024-43999](https://insights.sbomify.com/CVE-2024-43999/): WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43998](https://insights.sbomify.com/CVE-2024-43998/): WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43997](https://insights.sbomify.com/CVE-2024-43997/): Cross-site scripting in EasyJobs (high 7.1)
- [CVE-2024-43996](https://insights.sbomify.com/CVE-2024-43996/): WordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-43995](https://insights.sbomify.com/CVE-2024-43995/): WordPress Posterity theme <= 3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43994](https://insights.sbomify.com/CVE-2024-43994/): WordPress Kahuna theme <= 1.7.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43993](https://insights.sbomify.com/CVE-2024-43993/): WordPress Liquido theme <= 1.0.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43992](https://insights.sbomify.com/CVE-2024-43992/): WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43991](https://insights.sbomify.com/CVE-2024-43991/): WordPress Hotel Galaxy theme <= 4.4.24 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43990](https://insights.sbomify.com/CVE-2024-43990/): WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-4399](https://insights.sbomify.com/CVE-2024-4399/): CAS <= 1.0.0 - Unauthenticated SSRF (critical 9.1)
- [CVE-2024-43989](https://insights.sbomify.com/CVE-2024-43989/): WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability (high 7.5)
- [CVE-2024-43988](https://insights.sbomify.com/CVE-2024-43988/): WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43987](https://insights.sbomify.com/CVE-2024-43987/): WordPress Sliding Door theme <= 3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43986](https://insights.sbomify.com/CVE-2024-43986/): WordPress E-cab taxi booking manager plugin <=1.0.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43985](https://insights.sbomify.com/CVE-2024-43985/): WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43984](https://insights.sbomify.com/CVE-2024-43984/): WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability (critical 9.6)
- [CVE-2024-43983](https://insights.sbomify.com/CVE-2024-43983/): WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43982](https://insights.sbomify.com/CVE-2024-43982/): WordPress Login As Users plugin <= 1.4.3 - Broken Access Control to Account Takeover vulnerability (high 8.8)
- [CVE-2024-43981](https://insights.sbomify.com/CVE-2024-43981/): WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43980](https://insights.sbomify.com/CVE-2024-43980/): WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-4398](https://insights.sbomify.com/CVE-2024-4398/): Cross-site scripting in HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player (medium 6.4)
- [CVE-2024-43979](https://insights.sbomify.com/CVE-2024-43979/): WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43978](https://insights.sbomify.com/CVE-2024-43978/): WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-43977](https://insights.sbomify.com/CVE-2024-43977/): WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43976](https://insights.sbomify.com/CVE-2024-43976/): WordPress Super Store Finder plugin <= 6.9.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-43975](https://insights.sbomify.com/CVE-2024-43975/): WordPress Super Store Finder plugin <= 6.9.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43974](https://insights.sbomify.com/CVE-2024-43974/): WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43973](https://insights.sbomify.com/CVE-2024-43973/): WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43972](https://insights.sbomify.com/CVE-2024-43972/): Cross-site scripting in PageLayer (medium 5.9)
- [CVE-2024-43971](https://insights.sbomify.com/CVE-2024-43971/): WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43970](https://insights.sbomify.com/CVE-2024-43970/): WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4397](https://insights.sbomify.com/CVE-2024-4397/): LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-43969](https://insights.sbomify.com/CVE-2024-43969/): WordPress Spiffy Calendar plugin <= 4.9.12 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-43968](https://insights.sbomify.com/CVE-2024-43968/): WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43967](https://insights.sbomify.com/CVE-2024-43967/): WordPress WP Testimonial Widget plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43966](https://insights.sbomify.com/CVE-2024-43966/): WordPress WP Testimonial Widget plugin <= 3.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-43965](https://insights.sbomify.com/CVE-2024-43965/): WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability (high 8.2)
- [CVE-2024-43964](https://insights.sbomify.com/CVE-2024-43964/): WordPress DSGVO All in one for WP plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43963](https://insights.sbomify.com/CVE-2024-43963/): WordPress Visual CSS Style Editor plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43962](https://insights.sbomify.com/CVE-2024-43962/): WordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-43961](https://insights.sbomify.com/CVE-2024-43961/): WordPress azurecurve Toggle Show/Hide plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43960](https://insights.sbomify.com/CVE-2024-43960/): WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43959](https://insights.sbomify.com/CVE-2024-43959/): WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43958](https://insights.sbomify.com/CVE-2024-43958/): WordPress Into The Dark theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43957](https://insights.sbomify.com/CVE-2024-43957/): WordPress Animated Number Counters plugin <= 1.9 - Editor+ Limited Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-43956](https://insights.sbomify.com/CVE-2024-43956/): WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43955](https://insights.sbomify.com/CVE-2024-43955/): WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability (critical 10.0)
- [CVE-2024-43954](https://insights.sbomify.com/CVE-2024-43954/): WordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability (medium 6.3)
- [CVE-2024-43953](https://insights.sbomify.com/CVE-2024-43953/): WordPress Classic Addons – WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43952](https://insights.sbomify.com/CVE-2024-43952/): WordPress Esotera theme <= 1.2.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43951](https://insights.sbomify.com/CVE-2024-43951/): WordPress Tempera theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43950](https://insights.sbomify.com/CVE-2024-43950/): WordPress Brickscore plugin <= 1.4.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4395](https://insights.sbomify.com/CVE-2024-4395/): Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege Escalation (high 7.3)
- [CVE-2024-43949](https://insights.sbomify.com/CVE-2024-43949/): WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43948](https://insights.sbomify.com/CVE-2024-43948/): WordPress WP Armour Extended plugin <= 1.26 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43947](https://insights.sbomify.com/CVE-2024-43947/): WordPress WP Armour Extended plugin <= 1.26 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-43946](https://insights.sbomify.com/CVE-2024-43946/): WordPress SKT Blocks plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43945](https://insights.sbomify.com/CVE-2024-43945/): WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2024-43944](https://insights.sbomify.com/CVE-2024-43944/): WordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerability (low 3.7)
- [CVE-2024-43943](https://insights.sbomify.com/CVE-2024-43943/): WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerability (high 8.5)
- [CVE-2024-43942](https://insights.sbomify.com/CVE-2024-43942/): WordPress Greenshift Query and Meta Addon plugin < 3.9.2 - Subscriber+ SQL Injection vulnerability (high 8.5)
- [CVE-2024-43941](https://insights.sbomify.com/CVE-2024-43941/): WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-43940](https://insights.sbomify.com/CVE-2024-43940/): WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability (medium 6.5)
- [CVE-2024-43939](https://insights.sbomify.com/CVE-2024-43939/): WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability (medium 6.5)
- [CVE-2024-43938](https://insights.sbomify.com/CVE-2024-43938/): WordPress Name Directory plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43937](https://insights.sbomify.com/CVE-2024-43937/): WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability (medium 6.4)
- [CVE-2024-43936](https://insights.sbomify.com/CVE-2024-43936/): WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43935](https://insights.sbomify.com/CVE-2024-43935/): Cross-site scripting in Delicious Recipes – WordPress Recipe Plugin (medium 6.5)
- [CVE-2024-43934](https://insights.sbomify.com/CVE-2024-43934/): WordPress Collapsing Archives plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43933](https://insights.sbomify.com/CVE-2024-43933/): WordPress WPMobile.App plugin <= 11.48 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-43932](https://insights.sbomify.com/CVE-2024-43932/): WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43931](https://insights.sbomify.com/CVE-2024-43931/): WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/277/