# Vulnerabilities published in 2024


- [CVE-2024-43233](https://insights.sbomify.com/CVE-2024-43233/): WordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43232](https://insights.sbomify.com/CVE-2024-43232/): WordPress Timeline and History slider plugin <= 2.3 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-43231](https://insights.sbomify.com/CVE-2024-43231/): WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43230](https://insights.sbomify.com/CVE-2024-43230/): Information disclosure in Shared Files (medium 5.3)
- [CVE-2024-4323](https://insights.sbomify.com/CVE-2024-4323/): Fluent Bit Memory Corruption Vulnerability (critical 9.8)
- [CVE-2024-43229](https://insights.sbomify.com/CVE-2024-43229/): WordPress WP Search Analytics plugin <= 1.4.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43228](https://insights.sbomify.com/CVE-2024-43228/): WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43227](https://insights.sbomify.com/CVE-2024-43227/): Cross-site scripting in BetterDocs (medium 6.5)
- [CVE-2024-43226](https://insights.sbomify.com/CVE-2024-43226/): WordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43225](https://insights.sbomify.com/CVE-2024-43225/): WordPress Enter Addons plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43224](https://insights.sbomify.com/CVE-2024-43224/): WordPress YaMaps for WordPress Plugin plugin <= 0.6.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43223](https://insights.sbomify.com/CVE-2024-43223/): WordPress EventPrime plugin <= 4.0.3.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43222](https://insights.sbomify.com/CVE-2024-43222/): WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-43221](https://insights.sbomify.com/CVE-2024-43221/): WordPress JetGridBuilder plugin <= 1.1.2 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-43220](https://insights.sbomify.com/CVE-2024-43220/): WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4322](https://insights.sbomify.com/CVE-2024-4322/): Path Traversal in parisneo/lollms-webui (high 7.5)
- [CVE-2024-43219](https://insights.sbomify.com/CVE-2024-43219/): WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43218](https://insights.sbomify.com/CVE-2024-43218/): WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43217](https://insights.sbomify.com/CVE-2024-43217/): WordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43216](https://insights.sbomify.com/CVE-2024-43216/): WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43215](https://insights.sbomify.com/CVE-2024-43215/): WordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43214](https://insights.sbomify.com/CVE-2024-43214/): WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-43213](https://insights.sbomify.com/CVE-2024-43213/): WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43212](https://insights.sbomify.com/CVE-2024-43212/): WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-43211](https://insights.sbomify.com/CVE-2024-43211/): WordPress MailChimp Subscribe Form plugin <=4.0.9.9 - Stored Cross-Site Scripting vulnerability (medium 5.9)
- [CVE-2024-43210](https://insights.sbomify.com/CVE-2024-43210/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4321](https://insights.sbomify.com/CVE-2024-4321/): Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-43209](https://insights.sbomify.com/CVE-2024-43209/): WordPress Bitly's WordPress Plugin plugin <= 2.7.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43208](https://insights.sbomify.com/CVE-2024-43208/): WordPress Send Emails with Mandrill plugin <= 1.4.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43207](https://insights.sbomify.com/CVE-2024-43207/): WordPress Unite Gallery Lite plugin <= 1.7.62 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-43204](https://insights.sbomify.com/CVE-2024-43204/): Apache HTTP Server: SSRF with mod_headers setting Content-Type header (high 7.5)
- [CVE-2024-43202](https://insights.sbomify.com/CVE-2024-43202/): Apache DolphinScheduler: Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-43201](https://insights.sbomify.com/CVE-2024-43201/): Planet Fitness Workouts mobile apps do not properly validate TLS certificates (high 8.7)
- [CVE-2024-4320](https://insights.sbomify.com/CVE-2024-4320/): Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-43199](https://insights.sbomify.com/CVE-2024-43199/): Privilege escalation in nagios:ndoutils (high 8.8)
- [CVE-2024-43196](https://insights.sbomify.com/CVE-2024-43196/): IBM OpenPages data manipulation (medium 4.3)
- [CVE-2024-43192](https://insights.sbomify.com/CVE-2024-43192/): IBM Storage TS4500 Library cross-site request forgery (medium 6.5)
- [CVE-2024-43191](https://insights.sbomify.com/CVE-2024-43191/): IBM ManageIQ command execution (high 7.2)
- [CVE-2024-43190](https://insights.sbomify.com/CVE-2024-43190/): IBM Engineering Requirements Management DOORS weak authentication (medium 5.9)
- [CVE-2024-4319](https://insights.sbomify.com/CVE-2024-4319/): Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2024-43189](https://insights.sbomify.com/CVE-2024-43189/): IBM Concert Software information disclosure (medium 5.9)
- [CVE-2024-43188](https://insights.sbomify.com/CVE-2024-43188/): IBM Business Automation Workflow improper input validation (medium 4.9)
- [CVE-2024-43187](https://insights.sbomify.com/CVE-2024-43187/): IBM Security Verify Access information disclosure (medium 5.9)
- [CVE-2024-43186](https://insights.sbomify.com/CVE-2024-43186/): IBM InfoSphere Information Server information disclosure (medium 5.3)
- [CVE-2024-43184](https://insights.sbomify.com/CVE-2024-43184/): IBM Jazz Foundation cross-site scripting (medium 6.1)
- [CVE-2024-43181](https://insights.sbomify.com/CVE-2024-43181/): Multiple Vulnerabilities in IBM Concert Software (medium 6.3)
- [CVE-2024-43180](https://insights.sbomify.com/CVE-2024-43180/): IBM Concert information disclosure (medium 4.3)
- [CVE-2024-4318](https://insights.sbomify.com/CVE-2024-4318/): Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection (high 8.8)
- [CVE-2024-43178](https://insights.sbomify.com/CVE-2024-43178/): Multiple Vulnerabilities in IBM Concert Software. (medium 5.9)
- [CVE-2024-43177](https://insights.sbomify.com/CVE-2024-43177/): IBM Concert improper certificate validation (medium 5.9)
- [CVE-2024-43176](https://insights.sbomify.com/CVE-2024-43176/): IBM OpenPages information disclosure (medium 5.4)
- [CVE-2024-43173](https://insights.sbomify.com/CVE-2024-43173/): IBM Concert information disclosure (low 3.7)
- [CVE-2024-4317](https://insights.sbomify.com/CVE-2024-4317/): PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (low 3.1)
- [CVE-2024-43169](https://insights.sbomify.com/CVE-2024-43169/): IBM Engineering Requirements Management DOORS Next file download (high 8.8)
- [CVE-2024-43168](https://insights.sbomify.com/CVE-2024-43168/): Unbound: heap-buffer-overflow in unbound (medium 4.8)
- [CVE-2024-43167](https://insights.sbomify.com/CVE-2024-43167/): Unbound: null pointer dereference in unbound (low 2.8)
- [CVE-2024-43166](https://insights.sbomify.com/CVE-2024-43166/): Apache DolphinScheduler Incorrect Default Permissions Vulnerability (critical 9.8)
- [CVE-2024-43165](https://insights.sbomify.com/CVE-2024-43165/): WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-43164](https://insights.sbomify.com/CVE-2024-43164/): WordPress Blockspare plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43163](https://insights.sbomify.com/CVE-2024-43163/): WordPress ParcelPanel plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43162](https://insights.sbomify.com/CVE-2024-43162/): WordPress Easy Digital Downloads plugin <= 3.2.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43161](https://insights.sbomify.com/CVE-2024-43161/): WordPress Slider & Popup Builder by Depicter plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43160](https://insights.sbomify.com/CVE-2024-43160/): WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-4316](https://insights.sbomify.com/CVE-2024-4316/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4)
- [CVE-2024-43159](https://insights.sbomify.com/CVE-2024-43159/): WordPress Masteriyo LMS plugin <= 1.11.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43158](https://insights.sbomify.com/CVE-2024-43158/): WordPress Masteriyo LMS plugin <= 1.11.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-43157](https://insights.sbomify.com/CVE-2024-43157/): WordPress FormCraft plugin <= 1.2.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43156](https://insights.sbomify.com/CVE-2024-43156/): WordPress Post Grid Master plugin <= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43155](https://insights.sbomify.com/CVE-2024-43155/): WordPress ComboBlocks plugin <= 2.2.86 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43154](https://insights.sbomify.com/CVE-2024-43154/): WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43153](https://insights.sbomify.com/CVE-2024-43153/): WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-43152](https://insights.sbomify.com/CVE-2024-43152/): WordPress 3D FlipBook plugin <= 1.15.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43151](https://insights.sbomify.com/CVE-2024-43151/): WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43150](https://insights.sbomify.com/CVE-2024-43150/): WordPress Xpro Elementor Addons plugin <= 1.4.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4315](https://insights.sbomify.com/CVE-2024-4315/): LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms (critical 9.1)
- [CVE-2024-43149](https://insights.sbomify.com/CVE-2024-43149/): WordPress CM Tooltip Glossary Plugin <= 4.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43148](https://insights.sbomify.com/CVE-2024-43148/): WordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43147](https://insights.sbomify.com/CVE-2024-43147/): WordPress Selection Lite plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43146](https://insights.sbomify.com/CVE-2024-43146/): WordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-43145](https://insights.sbomify.com/CVE-2024-43145/): WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-43144](https://insights.sbomify.com/CVE-2024-43144/): WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-43143](https://insights.sbomify.com/CVE-2024-43143/): WordPress Registrations for the Events Calendar plugin <= 2.12.1 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2024-43142](https://insights.sbomify.com/CVE-2024-43142/): WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43141](https://insights.sbomify.com/CVE-2024-43141/): WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-43140](https://insights.sbomify.com/CVE-2024-43140/): WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-4314](https://insights.sbomify.com/CVE-2024-4314/): hostel <= 1.1.5.3 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-43139](https://insights.sbomify.com/CVE-2024-43139/): WordPress Football Pool plugin <= 2.11.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43138](https://insights.sbomify.com/CVE-2024-43138/): WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-43137](https://insights.sbomify.com/CVE-2024-43137/): WordPress WappPress Basic plugin <= 6.0.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43136](https://insights.sbomify.com/CVE-2024-43136/): WordPress Sunshine Photo Cart plugin <= 3.2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43135](https://insights.sbomify.com/CVE-2024-43135/): WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-43134](https://insights.sbomify.com/CVE-2024-43134/): WordPress Waitlist Woocommerce plugin <= 2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43133](https://insights.sbomify.com/CVE-2024-43133/): WordPress Themify Shortcodes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43132](https://insights.sbomify.com/CVE-2024-43132/): SQL injection in Docket (WooCommerce Collections / Wishlist / Watchlist) (critical 9.3)
- [CVE-2024-43131](https://insights.sbomify.com/CVE-2024-43131/): Missing authorization in Docket (WooCommerce Collections / Wishlist / Watchlist) (high 7.5)
- [CVE-2024-43130](https://insights.sbomify.com/CVE-2024-43130/): WordPress Football Pool plugin <= 2.11.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-4313](https://insights.sbomify.com/CVE-2024-4313/): Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter (medium 6.4)
- [CVE-2024-43129](https://insights.sbomify.com/CVE-2024-43129/): WordPress BetterDocs plugin <= 3.5.8 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-43128](https://insights.sbomify.com/CVE-2024-43128/): WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerability (medium 6.5)
- [CVE-2024-43127](https://insights.sbomify.com/CVE-2024-43127/): Cross-site scripting in Products, Order & Customers Export for WooCommerce (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/285/