# Vulnerabilities published in 2024


- [CVE-2024-43325](https://insights.sbomify.com/CVE-2024-43325/): WordPress Dark Mode for WP Dashboard plugin <= 1.2.3 - Cross Site Request Forgery vulnerability (medium 4.3)
- [CVE-2024-43324](https://insights.sbomify.com/CVE-2024-43324/): WordPress Clever Addons for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43323](https://insights.sbomify.com/CVE-2024-43323/): WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43322](https://insights.sbomify.com/CVE-2024-43322/): WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2024-43321](https://insights.sbomify.com/CVE-2024-43321/): WordPress Team Showcase plugin <= 1.22.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43320](https://insights.sbomify.com/CVE-2024-43320/): WordPress WPBakery Page Builder Addons plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4332](https://insights.sbomify.com/CVE-2024-4332/): Improper Authentication in Tripwire Enterprise 9.1.0 APIs (critical 9.3)
- [CVE-2024-43319](https://insights.sbomify.com/CVE-2024-43319/): WordPress HTML5 Video Player plugin <= 2.5.31 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-43318](https://insights.sbomify.com/CVE-2024-43318/): WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43317](https://insights.sbomify.com/CVE-2024-43317/): WordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerability (medium 4.3)
- [CVE-2024-43316](https://insights.sbomify.com/CVE-2024-43316/): WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43315](https://insights.sbomify.com/CVE-2024-43315/): WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2024-43314](https://insights.sbomify.com/CVE-2024-43314/): WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43313](https://insights.sbomify.com/CVE-2024-43313/): WordPress FormFacade plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43312](https://insights.sbomify.com/CVE-2024-43312/): WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.1.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-43311](https://insights.sbomify.com/CVE-2024-43311/): WordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-43310](https://insights.sbomify.com/CVE-2024-43310/): Missing authorization in Print Barcode Labels for your WooCommerce products/orders (medium 6.5)
- [CVE-2024-4331](https://insights.sbomify.com/CVE-2024-4331/): Use after free in Chrome (high 7.5)
- [CVE-2024-43309](https://insights.sbomify.com/CVE-2024-43309/): WordPress WP Telegram Widget and Join Link plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43308](https://insights.sbomify.com/CVE-2024-43308/): Cross-site scripting in Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor (medium 6.5)
- [CVE-2024-43307](https://insights.sbomify.com/CVE-2024-43307/): WordPress Structured Content (JSON-LD) #wpsc plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43306](https://insights.sbomify.com/CVE-2024-43306/): WordPress WP-Lister Lite for eBay plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43305](https://insights.sbomify.com/CVE-2024-43305/): WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43304](https://insights.sbomify.com/CVE-2024-43304/): WordPress Cryptocurrency Widgets plugin <= 2.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43303](https://insights.sbomify.com/CVE-2024-43303/): WordPress White Label CMS plugin <= 2.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43302](https://insights.sbomify.com/CVE-2024-43302/): WordPress Fonts plugin <= 3.7.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43301](https://insights.sbomify.com/CVE-2024-43301/): WordPress Fonts plugin <= 3.7.7 - Cross Site Request Forgery (CSRF) to Stored XSSvulnerability (high 7.1)
- [CVE-2024-43300](https://insights.sbomify.com/CVE-2024-43300/): WordPress Movie Database plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-4330](https://insights.sbomify.com/CVE-2024-4330/): Path Traversal in parisneo/lollms-webui (medium 4.0)
- [CVE-2024-43299](https://insights.sbomify.com/CVE-2024-43299/): WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-43298](https://insights.sbomify.com/CVE-2024-43298/): WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43297](https://insights.sbomify.com/CVE-2024-43297/): WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43296](https://insights.sbomify.com/CVE-2024-43296/): WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43295](https://insights.sbomify.com/CVE-2024-43295/): WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43294](https://insights.sbomify.com/CVE-2024-43294/): WordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43293](https://insights.sbomify.com/CVE-2024-43293/): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43292](https://insights.sbomify.com/CVE-2024-43292/): Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce (medium 5.9)
- [CVE-2024-43291](https://insights.sbomify.com/CVE-2024-43291/): Cross-site scripting in Void Contact Form 7 Widget For Elementor Page Builder (medium 5.9)
- [CVE-2024-43290](https://insights.sbomify.com/CVE-2024-43290/): WordPress Atarim plugin <= 4.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-4329](https://insights.sbomify.com/CVE-2024-4329/): Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-43289](https://insights.sbomify.com/CVE-2024-43289/): WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-43288](https://insights.sbomify.com/CVE-2024-43288/): WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-43287](https://insights.sbomify.com/CVE-2024-43287/): WordPress Brevo plugin <= 3.1.82 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43286](https://insights.sbomify.com/CVE-2024-43286/): WordPress Squirrly SEO plugin <= 12.3.19 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-43285](https://insights.sbomify.com/CVE-2024-43285/): WordPress Presto Player plugin <= 3.0.2 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-43284](https://insights.sbomify.com/CVE-2024-43284/): WordPress WP Travel Gutenberg Blocks plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43283](https://insights.sbomify.com/CVE-2024-43283/): WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability (medium 5.3)
- [CVE-2024-43282](https://insights.sbomify.com/CVE-2024-43282/): WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-43281](https://insights.sbomify.com/CVE-2024-43281/): WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.3 - Local File Inclusion vulnerability (medium 5.3)
- [CVE-2024-43280](https://insights.sbomify.com/CVE-2024-43280/): WordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-4328](https://insights.sbomify.com/CVE-2024-4328/): CSRF in clear_personality_files_list in parisneo/lollms-webui (medium 4.0)
- [CVE-2024-43279](https://insights.sbomify.com/CVE-2024-43279/): WordPress Newsletters plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43278](https://insights.sbomify.com/CVE-2024-43278/): WordPress Meta Field Block plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43277](https://insights.sbomify.com/CVE-2024-43277/): WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43276](https://insights.sbomify.com/CVE-2024-43276/): WordPress Child Theme Creator by Orbisius plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43274](https://insights.sbomify.com/CVE-2024-43274/): WordPress JS Help Desk – The Ultimate Help Desk plugin <= 2.8.6 - Broken Access Control vulnerability (medium 5.8)
- [CVE-2024-43273](https://insights.sbomify.com/CVE-2024-43273/): WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-43272](https://insights.sbomify.com/CVE-2024-43272/): WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability (medium 5.3)
- [CVE-2024-43271](https://insights.sbomify.com/CVE-2024-43271/): WordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.0 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-43270](https://insights.sbomify.com/CVE-2024-43270/): WordPress Backup and Restore WordPress plugin <= 1.50 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-4327](https://insights.sbomify.com/CVE-2024-4327/): Apryse WebViewer PDF Document cross site scripting (low 3.5)
- [CVE-2024-43269](https://insights.sbomify.com/CVE-2024-43269/): WordPress Backup and Restore WordPress plugin <= 1.50 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43268](https://insights.sbomify.com/CVE-2024-43268/): WordPress Backup and Restore WordPress plugin <= 1.50 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-43267](https://insights.sbomify.com/CVE-2024-43267/): WordPress Mega Addons For Elementor plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43266](https://insights.sbomify.com/CVE-2024-43266/): WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2024-43265](https://insights.sbomify.com/CVE-2024-43265/): WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout Vulnerability (medium 4.3)
- [CVE-2024-43264](https://insights.sbomify.com/CVE-2024-43264/): WordPress Create by Mediavine plugin <= 1.9.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-43263](https://insights.sbomify.com/CVE-2024-43263/): WordPress Visual Composer Starter theme <= 3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43262](https://insights.sbomify.com/CVE-2024-43262/): WordPress Busiprof theme <= 2.4.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43261](https://insights.sbomify.com/CVE-2024-43261/): WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability (critical 9.6)
- [CVE-2024-43260](https://insights.sbomify.com/CVE-2024-43260/): WordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-4326](https://insights.sbomify.com/CVE-2024-4326/): Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-43259](https://insights.sbomify.com/CVE-2024-43259/): WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-43258](https://insights.sbomify.com/CVE-2024-43258/): WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-43257](https://insights.sbomify.com/CVE-2024-43257/): WordPress Leopard plugin <= 2.0.36 - Subscriber+ Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2024-43256](https://insights.sbomify.com/CVE-2024-43256/): WordPress Leopard plugin <= 2.0.36 - Subscriber+ Plugin Settings Change vulnerability (high 7.1)
- [CVE-2024-43255](https://insights.sbomify.com/CVE-2024-43255/): WordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.3.9 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-43254](https://insights.sbomify.com/CVE-2024-43254/): WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43253](https://insights.sbomify.com/CVE-2024-43253/): WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43252](https://insights.sbomify.com/CVE-2024-43252/): WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-43251](https://insights.sbomify.com/CVE-2024-43251/): WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2024-43250](https://insights.sbomify.com/CVE-2024-43250/): WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Plugin Settings Change vulnerability (high 7.1)
- [CVE-2024-4325](https://insights.sbomify.com/CVE-2024-4325/): Server-Side Request Forgery (SSRF) in gradio-app/gradio (high 8.6)
- [CVE-2024-43249](https://insights.sbomify.com/CVE-2024-43249/): WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-43248](https://insights.sbomify.com/CVE-2024-43248/): WordPress Bit Form Pro plugin <= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-43247](https://insights.sbomify.com/CVE-2024-43247/): WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerability (high 8.8)
- [CVE-2024-43246](https://insights.sbomify.com/CVE-2024-43246/): WordPress WHMpress plugin <= 6.2-revision-5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43245](https://insights.sbomify.com/CVE-2024-43245/): WordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2024-43244](https://insights.sbomify.com/CVE-2024-43244/): WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43243](https://insights.sbomify.com/CVE-2024-43243/): WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-43242](https://insights.sbomify.com/CVE-2024-43242/): WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-43241](https://insights.sbomify.com/CVE-2024-43241/): WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43240](https://insights.sbomify.com/CVE-2024-43240/): WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerability (critical 9.4)
- [CVE-2024-4324](https://insights.sbomify.com/CVE-2024-4324/): WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (medium 6.4)
- [CVE-2024-43239](https://insights.sbomify.com/CVE-2024-43239/): WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability (medium 4.3)
- [CVE-2024-43238](https://insights.sbomify.com/CVE-2024-43238/): WordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43237](https://insights.sbomify.com/CVE-2024-43237/): WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-43236](https://insights.sbomify.com/CVE-2024-43236/): WordPress Easy PayPal & Stripe Buy Now Button plugin <= 1.9 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-43235](https://insights.sbomify.com/CVE-2024-43235/): WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-43234](https://insights.sbomify.com/CVE-2024-43234/): WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/284/