# Vulnerabilities published in 2024


- [CVE-2024-38762](https://insights.sbomify.com/CVE-2024-38762/): WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38761](https://insights.sbomify.com/CVE-2024-38761/): WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability (high 7.5)
- [CVE-2024-38760](https://insights.sbomify.com/CVE-2024-38760/): WordPress Send Users Email plugin <= 1.5.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-3876](https://insights.sbomify.com/CVE-2024-3876/): Tenda F1202 VirtualSer fromVirtualSer stack-based overflow (high 8.8)
- [CVE-2024-38759](https://insights.sbomify.com/CVE-2024-38759/): WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability (medium 5.4)
- [CVE-2024-38758](https://insights.sbomify.com/CVE-2024-38758/): WordPress WappPress plugin <= 6.0.4 - Blind Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-38757](https://insights.sbomify.com/CVE-2024-38757/): WordPress Typebot plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38756](https://insights.sbomify.com/CVE-2024-38756/): Information disclosure in Coming Soon (medium 5.3)
- [CVE-2024-38755](https://insights.sbomify.com/CVE-2024-38755/): WordPress DirectoryPress plugin <= 3.6.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-38754](https://insights.sbomify.com/CVE-2024-38754/): WordPress Tagbox plugin <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38753](https://insights.sbomify.com/CVE-2024-38753/): WordPress Animated Rotating Words Plugin <= 5.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38752](https://insights.sbomify.com/CVE-2024-38752/): WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38751](https://insights.sbomify.com/CVE-2024-38751/): WordPress AdsforWP plugin <= 1.9.28 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38750](https://insights.sbomify.com/CVE-2024-38750/): WordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3875](https://insights.sbomify.com/CVE-2024-3875/): Tenda F1202 Natlimit fromNatlimit stack-based overflow (high 8.8)
- [CVE-2024-38749](https://insights.sbomify.com/CVE-2024-38749/): WordPress Olive One Click Demo Import plugin <= 1.1.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-38748](https://insights.sbomify.com/CVE-2024-38748/): WordPress EleForms plugin <= 2.9.9.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38747](https://insights.sbomify.com/CVE-2024-38747/): WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-38746](https://insights.sbomify.com/CVE-2024-38746/): WordPress MakeStories (for Google Web Stories) plugin <= 3.0.3 - Arbitrary File Download and SSRF vulnerability (high 7.1)
- [CVE-2024-38745](https://insights.sbomify.com/CVE-2024-38745/): WordPress Wholesale Suite plugin <= 2.1.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38744](https://insights.sbomify.com/CVE-2024-38744/): WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability (high 8.3)
- [CVE-2024-38743](https://insights.sbomify.com/CVE-2024-38743/): WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38742](https://insights.sbomify.com/CVE-2024-38742/): WordPress MBE eShip plugin <= 2.1.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-38741](https://insights.sbomify.com/CVE-2024-38741/): WordPress Amazing Hover Effects plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38740](https://insights.sbomify.com/CVE-2024-38740/): WordPress Packlink PRO shipping module plugin <= 3.4.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-3874](https://insights.sbomify.com/CVE-2024-3874/): Tenda W20E SetRemoteWebManage formSetRemoteWebManage stack-based overflow (high 8.8)
- [CVE-2024-38739](https://insights.sbomify.com/CVE-2024-38739/): WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability (medium 5.1)
- [CVE-2024-38738](https://insights.sbomify.com/CVE-2024-38738/): WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-38737](https://insights.sbomify.com/CVE-2024-38737/): WordPress ReDi Restaurant Reservation plugin <= 24.0422 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-38736](https://insights.sbomify.com/CVE-2024-38736/): WordPress Realtyna Organic IDX plugin <= 4.14.13 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-38735](https://insights.sbomify.com/CVE-2024-38735/): WordPress Event post plugin <= 5.9.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-38734](https://insights.sbomify.com/CVE-2024-38734/): WordPress Import Spreadsheets from Microsoft Excel plugin <= 10.1.4 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-38733](https://insights.sbomify.com/CVE-2024-38733/): WordPress Meks Video Importer plugin <= 1.0.12 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-38732](https://insights.sbomify.com/CVE-2024-38732/): WordPress Patricia Blog theme <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38731](https://insights.sbomify.com/CVE-2024-38731/): WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38730](https://insights.sbomify.com/CVE-2024-38730/): WordPress Magical Addons For Elementor plugin <= 1.1.41 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-3873](https://insights.sbomify.com/CVE-2024-3873/): SMI SMI-EX-5414W Web Interface cross-site request forgery (medium 4.3)
- [CVE-2024-38729](https://insights.sbomify.com/CVE-2024-38729/): WordPress MBE eShip plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-38728](https://insights.sbomify.com/CVE-2024-38728/): WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Server Side Request Forgery (SSRF) vulnerability (high 7.1)
- [CVE-2024-38727](https://insights.sbomify.com/CVE-2024-38727/): WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-38726](https://insights.sbomify.com/CVE-2024-38726/): WordPress Product Designer plugin <= 1.0.33 - Arbitrary Content Deletion vulnerability (high 7.5)
- [CVE-2024-38725](https://insights.sbomify.com/CVE-2024-38725/): WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-38724](https://insights.sbomify.com/CVE-2024-38724/): WordPress Contact Form 7 Summary and Print plugin <= 1.2.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-38723](https://insights.sbomify.com/CVE-2024-38723/): WordPress Get Use APIs – JSON Content Importer plugin <= 1.5.6 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2024-38722](https://insights.sbomify.com/CVE-2024-38722/): WordPress Job Board Manager plugin <= 2.1.57 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38721](https://insights.sbomify.com/CVE-2024-38721/): WordPress EazyDocs plugin <= 2.5.0 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-38720](https://insights.sbomify.com/CVE-2024-38720/): WordPress EazyDocs plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3872](https://insights.sbomify.com/CVE-2024-3872/): Denial of service in Mattermost (low 3.1)
- [CVE-2024-38719](https://insights.sbomify.com/CVE-2024-38719/): WordPress Auto Featured Image plugin <= 4.1.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-38718](https://insights.sbomify.com/CVE-2024-38718/): WordPress Download Button for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38717](https://insights.sbomify.com/CVE-2024-38717/): WordPress Booking Ultra Pro Appointments Booking Calendar plugin <= 1.1.13 - Local File Inclusion vulnerability (high 7.1)
- [CVE-2024-38716](https://insights.sbomify.com/CVE-2024-38716/): WordPress Events Calendar for Google plugin <= 2.1.0 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-38715](https://insights.sbomify.com/CVE-2024-38715/): WordPress ExS Widgets plugin <= 0.3.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-38714](https://insights.sbomify.com/CVE-2024-38714/): WordPress WP Fast Total Search <= 1.68.232 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-38713](https://insights.sbomify.com/CVE-2024-38713/): WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38712](https://insights.sbomify.com/CVE-2024-38712/): WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38711](https://insights.sbomify.com/CVE-2024-38711/): WordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38710](https://insights.sbomify.com/CVE-2024-38710/): Cross-site scripting in Master Addons for Elementor (medium 5.9)
- [CVE-2024-3871](https://insights.sbomify.com/CVE-2024-3871/): Authenticated Remote Command Injection in Delta Electronics DVW (critical 9.8)
- [CVE-2024-38709](https://insights.sbomify.com/CVE-2024-38709/): WordPress GD Rating System plugin <= 3.6 - Local File Inclusion vulnerability (medium 5.3)
- [CVE-2024-38708](https://insights.sbomify.com/CVE-2024-38708/): WordPress Barcode Scanner and Inventory manager plugin <= 1.6.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-38707](https://insights.sbomify.com/CVE-2024-38707/): WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-38706](https://insights.sbomify.com/CVE-2024-38706/): WordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability (medium 6.5)
- [CVE-2024-38705](https://insights.sbomify.com/CVE-2024-38705/): WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38704](https://insights.sbomify.com/CVE-2024-38704/): WordPress Team Manager plugin <= 2.1.12 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-38703](https://insights.sbomify.com/CVE-2024-38703/): WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38702](https://insights.sbomify.com/CVE-2024-38702/): WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38701](https://insights.sbomify.com/CVE-2024-38701/): WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-38700](https://insights.sbomify.com/CVE-2024-38700/): Code injection in WPCS (medium 6.5)
- [CVE-2024-3870](https://insights.sbomify.com/CVE-2024-3870/): Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-38699](https://insights.sbomify.com/CVE-2024-38699/): WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability (high 7.5)
- [CVE-2024-38698](https://insights.sbomify.com/CVE-2024-38698/): WordPress SKT Skill Bar plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38697](https://insights.sbomify.com/CVE-2024-38697/): WordPress Goftino plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38696](https://insights.sbomify.com/CVE-2024-38696/): WordPress Zoho CRM Lead Magnet plugin <= 1.7.8.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38695](https://insights.sbomify.com/CVE-2024-38695/): WordPress WP GoToWebinar plugin <= 15.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-38694](https://insights.sbomify.com/CVE-2024-38694/): WordPress Moloni plugin <= 4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38693](https://insights.sbomify.com/CVE-2024-38693/): WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-38692](https://insights.sbomify.com/CVE-2024-38692/): WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-38691](https://insights.sbomify.com/CVE-2024-38691/): WordPress Metorik plugin <= 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38690](https://insights.sbomify.com/CVE-2024-38690/): WordPress iPanorama 360 plugin <= 1.8.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-3869](https://insights.sbomify.com/CVE-2024-3869/): Customer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search (medium 4.3)
- [CVE-2024-38689](https://insights.sbomify.com/CVE-2024-38689/): WordPress Simple Popup plugin <= 4.4 - Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-38687](https://insights.sbomify.com/CVE-2024-38687/): WordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38686](https://insights.sbomify.com/CVE-2024-38686/): WordPress FancyPost plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38685](https://insights.sbomify.com/CVE-2024-38685/): WordPress WP Announcement plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-38684](https://insights.sbomify.com/CVE-2024-38684/): WordPress SlingBlocks plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38683](https://insights.sbomify.com/CVE-2024-38683/): WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38682](https://insights.sbomify.com/CVE-2024-38682/): WordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38681](https://insights.sbomify.com/CVE-2024-38681/): WordPress Magical Addons For Elementor plugin <= 1.1.41 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38680](https://insights.sbomify.com/CVE-2024-38680/): WordPress Appmaker plugin <= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3868](https://insights.sbomify.com/CVE-2024-3868/): Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name (medium 5.4)
- [CVE-2024-38679](https://insights.sbomify.com/CVE-2024-38679/): WordPress Animated Typed JS Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38678](https://insights.sbomify.com/CVE-2024-38678/): WordPress Calendar.online / Kalender.digital – Plugin plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38677](https://insights.sbomify.com/CVE-2024-38677/): WordPress REVIEWS.io plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38676](https://insights.sbomify.com/CVE-2024-38676/): Cross-site scripting in Booking Ultra Pro (medium 6.5)
- [CVE-2024-38675](https://insights.sbomify.com/CVE-2024-38675/): WordPress Arkhe Blocks plugin 2.22.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38674](https://insights.sbomify.com/CVE-2024-38674/): WordPress SKT Addons for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38673](https://insights.sbomify.com/CVE-2024-38673/): WordPress Multisite Content Copier/Updater plugin <= 1.5.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38672](https://insights.sbomify.com/CVE-2024-38672/): WordPress AdPush plugin <= 1.50 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38671](https://insights.sbomify.com/CVE-2024-38671/): WordPress WP GoToWebinar plugin <= 15.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/318/