# Vulnerabilities published in 2024


- [CVE-2024-35714](https://insights.sbomify.com/CVE-2024-35714/): WordPress Idyllic theme <= 1.1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35713](https://insights.sbomify.com/CVE-2024-35713/): WordPress Testimonial Carousel For Elementor plugin <= 10.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35712](https://insights.sbomify.com/CVE-2024-35712/): WordPress Database Cleaner: Clean, Optimize & Repair plugin <= 1.0.5 - Arbitrary File Read vulnerability (medium 4.9)
- [CVE-2024-35711](https://insights.sbomify.com/CVE-2024-35711/): WordPress Event theme <= 1.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35710](https://insights.sbomify.com/CVE-2024-35710/): WordPress Podlove Web Player plugin <= 5.7.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-3571](https://insights.sbomify.com/CVE-2024-3571/): Path Traversal in langchain-ai/langchain (medium 6.5)
- [CVE-2024-35709](https://insights.sbomify.com/CVE-2024-35709/): WordPress The Plus Addons for Elementor plugin <= 5.5.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35708](https://insights.sbomify.com/CVE-2024-35708/): WordPress Rife Free theme <= 2.4.19 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35707](https://insights.sbomify.com/CVE-2024-35707/): WordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35706](https://insights.sbomify.com/CVE-2024-35706/): WordPress Heateor Social Login WordPress plugin <= 1.1.32 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35705](https://insights.sbomify.com/CVE-2024-35705/): WordPress Block for Font Awesome plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35704](https://insights.sbomify.com/CVE-2024-35704/): WordPress BlockArt Blocks plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35703](https://insights.sbomify.com/CVE-2024-35703/): WordPress Sina Extension for Elementor plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35702](https://insights.sbomify.com/CVE-2024-35702/): WordPress Master Addons for Elementor plugin <= 2.0.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35701](https://insights.sbomify.com/CVE-2024-35701/): WordPress PropertyHive plugin <= 2.0.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35700](https://insights.sbomify.com/CVE-2024-35700/): WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerability (critical 9.8)
- [CVE-2024-3570](https://insights.sbomify.com/CVE-2024-3570/): Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm (not scored)
- [CVE-2024-35699](https://insights.sbomify.com/CVE-2024-35699/): WordPress HT Feed plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35698](https://insights.sbomify.com/CVE-2024-35698/): WordPress YITH WooCommerce Tab Manager plugin <= 1.35.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35697](https://insights.sbomify.com/CVE-2024-35697/): WordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35696](https://insights.sbomify.com/CVE-2024-35696/): WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35695](https://insights.sbomify.com/CVE-2024-35695/): WordPress WP Docs plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35694](https://insights.sbomify.com/CVE-2024-35694/): WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35693](https://insights.sbomify.com/CVE-2024-35693/): WordPress 12 Step Meeting List plugin <= 3.14.33 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35692](https://insights.sbomify.com/CVE-2024-35692/): WordPress GDPR/CCPA Cookie Consent Banner plugin <= 3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35691](https://insights.sbomify.com/CVE-2024-35691/): WordPress Widget Options - Extended plugin <= 5.1.0 - Multiple Data Exposure Vulnerability (medium 6.5)
- [CVE-2024-35690](https://insights.sbomify.com/CVE-2024-35690/): WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability (medium 6.5)
- [CVE-2024-3569](https://insights.sbomify.com/CVE-2024-3569/): Denial of Service (DoS) Vulnerability in mintplex-labs/anything-llm (high 7.5)
- [CVE-2024-35689](https://insights.sbomify.com/CVE-2024-35689/): WordPress Analytify plugin <= 5.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-35688](https://insights.sbomify.com/CVE-2024-35688/): WordPress Master Addons for Elementor plugin <= 2.0.5.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35687](https://insights.sbomify.com/CVE-2024-35687/): WordPress Link Library plugin <= 7.6.3 - Reflected Cross-Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35686](https://insights.sbomify.com/CVE-2024-35686/): WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35685](https://insights.sbomify.com/CVE-2024-35685/): WordPress Radcliffe 2 theme <= 2.0.17 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35684](https://insights.sbomify.com/CVE-2024-35684/): WordPress ElasticPress plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35683](https://insights.sbomify.com/CVE-2024-35683/): WordPress Leyka plugin <= 3.31.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35682](https://insights.sbomify.com/CVE-2024-35682/): WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-35681](https://insights.sbomify.com/CVE-2024-35681/): WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35680](https://insights.sbomify.com/CVE-2024-35680/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability (medium 5.3)
- [CVE-2024-3568](https://insights.sbomify.com/CVE-2024-3568/): Arbitrary Code Execution via Deserialization in huggingface/transformers (low 3.4)
- [CVE-2024-35679](https://insights.sbomify.com/CVE-2024-35679/): WordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35678](https://insights.sbomify.com/CVE-2024-35678/): WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-35677](https://insights.sbomify.com/CVE-2024-35677/): WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-35676](https://insights.sbomify.com/CVE-2024-35676/): WordPress Recurring PayPal Donations plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35675](https://insights.sbomify.com/CVE-2024-35675/): WordPress Advanced Woo Labels plugin <= 1.93 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35674](https://insights.sbomify.com/CVE-2024-35674/): WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35673](https://insights.sbomify.com/CVE-2024-35673/): WordPress Pure Chat plugin <= 2.22 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35672](https://insights.sbomify.com/CVE-2024-35672/): WordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-35671](https://insights.sbomify.com/CVE-2024-35671/): WordPress MJ Update History plugin <= 1.0.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35670](https://insights.sbomify.com/CVE-2024-35670/): WordPress Integrate Google Drive plugin <= 1.3.93 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-3567](https://insights.sbomify.com/CVE-2024-3567/): Qemu-kvm: net: assertion failure in update_sctp_checksum() (medium 5.5)
- [CVE-2024-35669](https://insights.sbomify.com/CVE-2024-35669/): WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35668](https://insights.sbomify.com/CVE-2024-35668/): Cross-site scripting in Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue (high 7.1)
- [CVE-2024-35667](https://insights.sbomify.com/CVE-2024-35667/): WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35666](https://insights.sbomify.com/CVE-2024-35666/): WordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35665](https://insights.sbomify.com/CVE-2024-35665/): WordPress Insert Post Ads plugin <= 1.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35664](https://insights.sbomify.com/CVE-2024-35664/): WordPress WPvivid Backup for MainWP plugin <= 0.9.32 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35663](https://insights.sbomify.com/CVE-2024-35663/): WordPress WP Translate plugin <= 5.3.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-35662](https://insights.sbomify.com/CVE-2024-35662/): WordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-35661](https://insights.sbomify.com/CVE-2024-35661/): WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35660](https://insights.sbomify.com/CVE-2024-35660/): WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability (medium 6.5)
- [CVE-2024-3566](https://insights.sbomify.com/CVE-2024-3566/): Command injection vulnerability in programing languages on Microsoft Windows operating system. (critical 9.8)
- [CVE-2024-35659](https://insights.sbomify.com/CVE-2024-35659/): WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-35658](https://insights.sbomify.com/CVE-2024-35658/): Path traversal in Checkout Field Editor for WooCommerce (Pro) (high 8.6)
- [CVE-2024-35657](https://insights.sbomify.com/CVE-2024-35657/): WordPress WP-Recall plugin <= 16.26.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-35656](https://insights.sbomify.com/CVE-2024-35656/): WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35655](https://insights.sbomify.com/CVE-2024-35655/): WordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35654](https://insights.sbomify.com/CVE-2024-35654/): WordPress Responsive theme <= 5.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35653](https://insights.sbomify.com/CVE-2024-35653/): Cross-site scripting in Visual Composer Website Builder (medium 6.5)
- [CVE-2024-35652](https://insights.sbomify.com/CVE-2024-35652/): WordPress Event Tickets with Ticket Scanner plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35651](https://insights.sbomify.com/CVE-2024-35651/): WordPress WP Flow Plus plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35650](https://insights.sbomify.com/CVE-2024-35650/): WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability (medium 4.9)
- [CVE-2024-3565](https://insights.sbomify.com/CVE-2024-3565/): Cross-site scripting in Content Blocks (Custom Post Widget) (medium 6.4)
- [CVE-2024-35649](https://insights.sbomify.com/CVE-2024-35649/): WordPress Save as PDF Plugin by Pdfcrowd plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35648](https://insights.sbomify.com/CVE-2024-35648/): WordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35647](https://insights.sbomify.com/CVE-2024-35647/): WordPress Global Notification Bar plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35646](https://insights.sbomify.com/CVE-2024-35646/): WordPress Smartarget Message Bar plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35645](https://insights.sbomify.com/CVE-2024-35645/): WordPress Random Banner plugin <= 4.2.12 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35644](https://insights.sbomify.com/CVE-2024-35644/): WordPress Preferred Languages plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35643](https://insights.sbomify.com/CVE-2024-35643/): WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35642](https://insights.sbomify.com/CVE-2024-35642/): WordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35641](https://insights.sbomify.com/CVE-2024-35641/): WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35640](https://insights.sbomify.com/CVE-2024-35640/): WordPress Safety Exit plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3564](https://insights.sbomify.com/CVE-2024-3564/): Content Blocks (Custom Post Widget) <= 3.3.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (high 8.8)
- [CVE-2024-35639](https://insights.sbomify.com/CVE-2024-35639/): WordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35638](https://insights.sbomify.com/CVE-2024-35638/): WordPress ActiveDEMAND plugin <= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35637](https://insights.sbomify.com/CVE-2024-35637/): WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-35636](https://insights.sbomify.com/CVE-2024-35636/): Cross-site request forgery in Uploadcare File Uploader and Adaptive Delivery (beta) (medium 4.3)
- [CVE-2024-35635](https://insights.sbomify.com/CVE-2024-35635/): WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-35634](https://insights.sbomify.com/CVE-2024-35634/): Woocommerce – Recent Purchases plugin <= 1.0.1 - File Inclusion vulnerability (medium 4.9)
- [CVE-2024-35633](https://insights.sbomify.com/CVE-2024-35633/): WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-35632](https://insights.sbomify.com/CVE-2024-35632/): Cross-site request forgery in Integration for Contact Form 7 and Constant Contact (medium 4.3)
- [CVE-2024-35631](https://insights.sbomify.com/CVE-2024-35631/): WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35630](https://insights.sbomify.com/CVE-2024-35630/): WordPress WP TripAdvisor Review Slider plugin <= 12.6 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-3563](https://insights.sbomify.com/CVE-2024-3563/): Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes (medium 6.4)
- [CVE-2024-35629](https://insights.sbomify.com/CVE-2024-35629/): WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerability (critical 9.6)
- [CVE-2024-35628](https://insights.sbomify.com/CVE-2024-35628/): WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35627](https://insights.sbomify.com/CVE-2024-35627/): tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key. (medium 6.1)
- [CVE-2024-35621](https://insights.sbomify.com/CVE-2024-35621/): formwork Cross-site scripting vulnerability in Markdown fields (medium 4.8)
- [CVE-2024-3562](https://insights.sbomify.com/CVE-2024-3562/): Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field (high 8.8)
- [CVE-2024-35618](https://insights.sbomify.com/CVE-2024-35618/): Null dereference in pingcap:tidb (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/345/