# Vulnerabilities published in 2024


- [CVE-2024-37511](https://insights.sbomify.com/CVE-2024-37511/): WordPress Swift Performance Lite plugin <= 2.3.6.20 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37510](https://insights.sbomify.com/CVE-2024-37510/): WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-3751](https://insights.sbomify.com/CVE-2024-3751/): Seriously Simple Podcasting < 3.3.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-37509](https://insights.sbomify.com/CVE-2024-37509/): WordPress MakeCommerce for WooCommerce plugin <= 3.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37508](https://insights.sbomify.com/CVE-2024-37508/): WordPress Construction Landing Page theme <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37507](https://insights.sbomify.com/CVE-2024-37507/): WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37506](https://insights.sbomify.com/CVE-2024-37506/): WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37505](https://insights.sbomify.com/CVE-2024-37505/): WordPress Business One Page theme <= 1.2.9 - Broken Access Control on Notice Dismissal vulnerability (medium 4.3)
- [CVE-2024-37504](https://insights.sbomify.com/CVE-2024-37504/): WordPress FileBird Document Library plugin <= 2.0.6 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-37503](https://insights.sbomify.com/CVE-2024-37503/): WordPress Lawyer Landing Page theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37502](https://insights.sbomify.com/CVE-2024-37502/): WordPress Social Login plugin <= 2.6.3 - PHP Object Injection vulnerability (medium 5.4)
- [CVE-2024-37501](https://insights.sbomify.com/CVE-2024-37501/): WordPress Advanced Classifieds & Directory Pro plugin <= 3.1.3 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37500](https://insights.sbomify.com/CVE-2024-37500/): WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3750](https://insights.sbomify.com/CVE-2024-3750/): Visualizer: Tables and Charts Manager for WordPress <= 3.10.15 - Missing Authorization to Arbitrary SQL Execution (high 8.8)
- [CVE-2024-37499](https://insights.sbomify.com/CVE-2024-37499/): WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-37498](https://insights.sbomify.com/CVE-2024-37498/): WordPress Tablesome plugin <= 1.0.33 - Sensitive Data Exposure via API vulnerability (medium 5.3)
- [CVE-2024-37497](https://insights.sbomify.com/CVE-2024-37497/): WordPress JetThemeCore plugin < 2.2.1 - Subscriber+ Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2024-37496](https://insights.sbomify.com/CVE-2024-37496/): WordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability (medium 4.3)
- [CVE-2024-37495](https://insights.sbomify.com/CVE-2024-37495/): WordPress Create by Mediavine plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37494](https://insights.sbomify.com/CVE-2024-37494/): WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-37493](https://insights.sbomify.com/CVE-2024-37493/): WordPress Posterity theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37492](https://insights.sbomify.com/CVE-2024-37492/): WordPress Gutenberg plugin <= 18.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37491](https://insights.sbomify.com/CVE-2024-37491/): WordPress Rife Free theme <= 2.4.18 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37490](https://insights.sbomify.com/CVE-2024-37490/): WordPress Bard theme <= 2.210 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3749](https://insights.sbomify.com/CVE-2024-3749/): SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR (medium 6.5)
- [CVE-2024-37489](https://insights.sbomify.com/CVE-2024-37489/): WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37488](https://insights.sbomify.com/CVE-2024-37488/): WordPress HelloAsso plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37487](https://insights.sbomify.com/CVE-2024-37487/): WordPress WP Directory Kit plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37486](https://insights.sbomify.com/CVE-2024-37486/): WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerability (high 7.6)
- [CVE-2024-37485](https://insights.sbomify.com/CVE-2024-37485/): WordPress bbPress Notify (No-Spam) plugin <= 2.18.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37484](https://insights.sbomify.com/CVE-2024-37484/): WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-37483](https://insights.sbomify.com/CVE-2024-37483/): WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-37482](https://insights.sbomify.com/CVE-2024-37482/): WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37481](https://insights.sbomify.com/CVE-2024-37481/): WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-37480](https://insights.sbomify.com/CVE-2024-37480/): WordPress Apollo13 Framework Extensions plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3748](https://insights.sbomify.com/CVE-2024-3748/): SP Project & Document Manager <= 4.71 - Data Update via IDOR (medium 6.5)
- [CVE-2024-37479](https://insights.sbomify.com/CVE-2024-37479/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37478](https://insights.sbomify.com/CVE-2024-37478/): WordPress Ashe theme <= 2.233 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37477](https://insights.sbomify.com/CVE-2024-37477/): WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-37476](https://insights.sbomify.com/CVE-2024-37476/): WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37475](https://insights.sbomify.com/CVE-2024-37475/): WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37474](https://insights.sbomify.com/CVE-2024-37474/): WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37473](https://insights.sbomify.com/CVE-2024-37473/): WordPress Trendy News theme <= 1.0.15 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37472](https://insights.sbomify.com/CVE-2024-37472/): WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37471](https://insights.sbomify.com/CVE-2024-37471/): WordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37470](https://insights.sbomify.com/CVE-2024-37470/): WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability (high 8.2)
- [CVE-2024-3747](https://insights.sbomify.com/CVE-2024-3747/): Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me block (medium 6.4)
- [CVE-2024-37469](https://insights.sbomify.com/CVE-2024-37469/): WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-37468](https://insights.sbomify.com/CVE-2024-37468/): WordPress Newsmatic theme <= 1.3.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37467](https://insights.sbomify.com/CVE-2024-37467/): WordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37466](https://insights.sbomify.com/CVE-2024-37466/): WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37465](https://insights.sbomify.com/CVE-2024-37465/): WordPress AI Power: Complete AI Pack – Powered by GPT-4 plugin <= 1.8.66 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37464](https://insights.sbomify.com/CVE-2024-37464/): WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.5 - Local File Inclusion vulnerability (medium 4.9)
- [CVE-2024-37463](https://insights.sbomify.com/CVE-2024-37463/): WordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37462](https://insights.sbomify.com/CVE-2024-37462/): WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37461](https://insights.sbomify.com/CVE-2024-37461/): WordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37460](https://insights.sbomify.com/CVE-2024-37460/): WordPress SuperSaaS – online appointment scheduling plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3746](https://insights.sbomify.com/CVE-2024-3746/): Measuresoft ScadaPro Improper Access Control (medium 6.8)
- [CVE-2024-37459](https://insights.sbomify.com/CVE-2024-37459/): WordPress PayPlus Payment Gateway plugin <= 6.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37458](https://insights.sbomify.com/CVE-2024-37458/): WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37457](https://insights.sbomify.com/CVE-2024-37457/): WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37456](https://insights.sbomify.com/CVE-2024-37456/): WordPress Simple Newsletter Plugin – Noptin plugin <= 3.4.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37455](https://insights.sbomify.com/CVE-2024-37455/): WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-37454](https://insights.sbomify.com/CVE-2024-37454/): WordPress AWSM Team – Team Showcase Plugin plugin <= 1.3.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-37453](https://insights.sbomify.com/CVE-2024-37453/): WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37452](https://insights.sbomify.com/CVE-2024-37452/): WordPress Schema Lite theme <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37451](https://insights.sbomify.com/CVE-2024-37451/): WordPress Travel Agency theme <= 1.4.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37450](https://insights.sbomify.com/CVE-2024-37450/): WordPress Benevolent theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3745](https://insights.sbomify.com/CVE-2024-3745/): MSI Afterburner v4.6.6.16381 Beta 3 - ACL Bypass (high 7.8)
- [CVE-2024-37449](https://insights.sbomify.com/CVE-2024-37449/): WordPress Slider Revolution plugin <= 6.7.13 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37448](https://insights.sbomify.com/CVE-2024-37448/): WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37447](https://insights.sbomify.com/CVE-2024-37447/): WordPress PixelYourSite plugin <= 9.6.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37446](https://insights.sbomify.com/CVE-2024-37446/): WordPress Chained Quiz plugin <= 1.3.2.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37445](https://insights.sbomify.com/CVE-2024-37445/): WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37444](https://insights.sbomify.com/CVE-2024-37444/): WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37443](https://insights.sbomify.com/CVE-2024-37443/): WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37442](https://insights.sbomify.com/CVE-2024-37442/): WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerability (low 3.8)
- [CVE-2024-37441](https://insights.sbomify.com/CVE-2024-37441/): WordPress NewsMash theme <= 1.0.34 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37440](https://insights.sbomify.com/CVE-2024-37440/): WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3744](https://insights.sbomify.com/CVE-2024-3744/): Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs (medium 6.5)
- [CVE-2024-37439](https://insights.sbomify.com/CVE-2024-37439/): Missing authorization in Uncanny Toolkit Pro for LearnDash (medium 5.4)
- [CVE-2024-37438](https://insights.sbomify.com/CVE-2024-37438/): WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-37437](https://insights.sbomify.com/CVE-2024-37437/): WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerability (medium 5.5)
- [CVE-2024-37436](https://insights.sbomify.com/CVE-2024-37436/): WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37435](https://insights.sbomify.com/CVE-2024-37435/): WordPress Perfect Portfolio theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37434](https://insights.sbomify.com/CVE-2024-37434/): WordPress Atarim plugin <= 3.31 - Authenticated Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37433](https://insights.sbomify.com/CVE-2024-37433/): WordPress Mailster plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37432](https://insights.sbomify.com/CVE-2024-37432/): WordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37431](https://insights.sbomify.com/CVE-2024-37431/): WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37430](https://insights.sbomify.com/CVE-2024-37430/): WordPress Patreon WordPress plugin <= 1.9.0 - Image Protection Bypass vulnerability (medium 5.3)
- [CVE-2024-3743](https://insights.sbomify.com/CVE-2024-3743/): Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-37429](https://insights.sbomify.com/CVE-2024-37429/): WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37428](https://insights.sbomify.com/CVE-2024-37428/): WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37427](https://insights.sbomify.com/CVE-2024-37427/): WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37426](https://insights.sbomify.com/CVE-2024-37426/): WordPress Elegant Pink theme 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37425](https://insights.sbomify.com/CVE-2024-37425/): WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-37424](https://insights.sbomify.com/CVE-2024-37424/): WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-37423](https://insights.sbomify.com/CVE-2024-37423/): WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability (high 8.5)
- [CVE-2024-37422](https://insights.sbomify.com/CVE-2024-37422/): WordPress Progress Planner plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37421](https://insights.sbomify.com/CVE-2024-37421/): WordPress JobScout theme <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/329/