# Vulnerabilities published in 2024


- [CVE-2024-32577](https://insights.sbomify.com/CVE-2024-32577/): WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32576](https://insights.sbomify.com/CVE-2024-32576/): WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32575](https://insights.sbomify.com/CVE-2024-32575/): WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32574](https://insights.sbomify.com/CVE-2024-32574/): WordPress WP Simple HTML Sitemap plugin <= 2.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32573](https://insights.sbomify.com/CVE-2024-32573/): WordPress WP-Lister Lite for eBay plugin <=3.5.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32572](https://insights.sbomify.com/CVE-2024-32572/): WordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32571](https://insights.sbomify.com/CVE-2024-32571/): WordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32570](https://insights.sbomify.com/CVE-2024-32570/): WordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3257](https://insights.sbomify.com/CVE-2024-3257/): SourceCodester Internship Portal Management System edit_activity_query.php sql injection (medium 6.3)
- [CVE-2024-32569](https://insights.sbomify.com/CVE-2024-32569/): WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32568](https://insights.sbomify.com/CVE-2024-32568/): WordPress WP 2FA plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32567](https://insights.sbomify.com/CVE-2024-32567/): WordPress DirectoryPress plugin <= 3.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32566](https://insights.sbomify.com/CVE-2024-32566/): WordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32565](https://insights.sbomify.com/CVE-2024-32565/): WordPress App Builder plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32564](https://insights.sbomify.com/CVE-2024-32564/): WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32563](https://insights.sbomify.com/CVE-2024-32563/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32562](https://insights.sbomify.com/CVE-2024-32562/): WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Cross Site Scripting (XSS) vulnerability (high 8.6)
- [CVE-2024-32561](https://insights.sbomify.com/CVE-2024-32561/): WordPress Tagembed plugin <= 4.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32560](https://insights.sbomify.com/CVE-2024-32560/): WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3256](https://insights.sbomify.com/CVE-2024-3256/): SourceCodester Internship Portal Management System edit_activity.php sql injection (medium 6.3)
- [CVE-2024-32559](https://insights.sbomify.com/CVE-2024-32559/): WordPress WP 404 Auto Redirect to Similar Post plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32558](https://insights.sbomify.com/CVE-2024-32558/): WordPress eCommerce Product Catalog plugin <= 3.3.32 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32557](https://insights.sbomify.com/CVE-2024-32557/): WordPress Exclusive Addons for Elementor plugin <= 2.6.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32556](https://insights.sbomify.com/CVE-2024-32556/): WordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32555](https://insights.sbomify.com/CVE-2024-32555/): WordPress Easy Real Estate plugin <= 2.2.6 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-32554](https://insights.sbomify.com/CVE-2024-32554/): WordPress Knight Lab Timeline plugin <= 3.9.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32553](https://insights.sbomify.com/CVE-2024-32553/): WordPress Superfly Menu plugin <= 5.0.25 - Subscriber+ Site-Wide Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32552](https://insights.sbomify.com/CVE-2024-32552/): Cross-site scripting in Taggbox (medium 6.5)
- [CVE-2024-32551](https://insights.sbomify.com/CVE-2024-32551/): WordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-32550](https://insights.sbomify.com/CVE-2024-32550/): WordPress BMI Adult & Kid Calculator plugin <= 1.2.1 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-3255](https://insights.sbomify.com/CVE-2024-3255/): SourceCodester Internship Portal Management System edit_admin_query.php sql injection (medium 6.3)
- [CVE-2024-32549](https://insights.sbomify.com/CVE-2024-32549/): WordPress Related Posts for WordPress plugin <= 4.0.3 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-32548](https://insights.sbomify.com/CVE-2024-32548/): WordPress What's New Generator plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32547](https://insights.sbomify.com/CVE-2024-32547/): WordPress Code Insert Manager (Q2W3 Inc Manager) plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-32546](https://insights.sbomify.com/CVE-2024-32546/): WordPress Tax Rate Upload plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32545](https://insights.sbomify.com/CVE-2024-32545/): WordPress Canva – Design beautiful blog graphics plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32544](https://insights.sbomify.com/CVE-2024-32544/): WordPress Netgsm plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32543](https://insights.sbomify.com/CVE-2024-32543/): WordPress MJ Update History plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32542](https://insights.sbomify.com/CVE-2024-32542/): WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32541](https://insights.sbomify.com/CVE-2024-32541/): WordPress WP-Cufon plugin <= 1.6.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32540](https://insights.sbomify.com/CVE-2024-32540/): WordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3254](https://insights.sbomify.com/CVE-2024-3254/): SourceCodester Internship Portal Management System edit_admin.php sql injection (medium 6.3)
- [CVE-2024-32539](https://insights.sbomify.com/CVE-2024-32539/): WordPress WP File Download Light plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32538](https://insights.sbomify.com/CVE-2024-32538/): WordPress Easy CountDowner plugin <= 1.0.8 - CSRF to XSS vulnerability (medium 6.5)
- [CVE-2024-32537](https://insights.sbomify.com/CVE-2024-32537/): WordPress Flash Video Player plugin <= 5.0.4 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-32536](https://insights.sbomify.com/CVE-2024-32536/): WordPress WP TradingView plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32535](https://insights.sbomify.com/CVE-2024-32535/): WordPress Access Category Password plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32534](https://insights.sbomify.com/CVE-2024-32534/): WordPress Form Maker plugin <= 1.15.23 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32533](https://insights.sbomify.com/CVE-2024-32533/): WordPress LH Add Media From Url plugin <= 1.22 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32532](https://insights.sbomify.com/CVE-2024-32532/): WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32531](https://insights.sbomify.com/CVE-2024-32531/): WordPress GuCherry Blog theme <= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32530](https://insights.sbomify.com/CVE-2024-32530/): WordPress Simple Testimonials Showcase plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3253](https://insights.sbomify.com/CVE-2024-3253/): SourceCodester Internship Portal Management System add_admin.php sql injection (medium 6.3)
- [CVE-2024-32529](https://insights.sbomify.com/CVE-2024-32529/): WordPress Yoga Schedule Momoyoga plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32528](https://insights.sbomify.com/CVE-2024-32528/): WordPress WP Dynamic Keywords Injector plugin <= 2.3.18 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32527](https://insights.sbomify.com/CVE-2024-32527/): WordPress Jotform Online Forms plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32526](https://insights.sbomify.com/CVE-2024-32526/): WordPress Easy Textillate plugin <= 2.02 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32525](https://insights.sbomify.com/CVE-2024-32525/): WordPress Theme My Login plugin <= 7.1.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32524](https://insights.sbomify.com/CVE-2024-32524/): WordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32523](https://insights.sbomify.com/CVE-2024-32523/): WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability (high 8.1)
- [CVE-2024-32522](https://insights.sbomify.com/CVE-2024-32522/): WordPress Open Close WooCommerce Store plugin <= 4.9.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32521](https://insights.sbomify.com/CVE-2024-32521/): WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerability (medium 5.3)
- [CVE-2024-32520](https://insights.sbomify.com/CVE-2024-32520/): WordPress WPC Grouped Product for WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3252](https://insights.sbomify.com/CVE-2024-3252/): SourceCodester Internship Portal Management System check_admin.php sql injection (medium 6.3)
- [CVE-2024-32519](https://insights.sbomify.com/CVE-2024-32519/): WordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32518](https://insights.sbomify.com/CVE-2024-32518/): WordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32517](https://insights.sbomify.com/CVE-2024-32517/): Missing authorization in Custom Thank You Page Customize For WooCommerce by Binary Carpenter (medium 4.3)
- [CVE-2024-32516](https://insights.sbomify.com/CVE-2024-32516/): WordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32515](https://insights.sbomify.com/CVE-2024-32515/): WordPress Mega Addons For Elementor plugin <= 1.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32514](https://insights.sbomify.com/CVE-2024-32514/): WordPress WP Poll Maker plugin <= 3.4 - Authenticated Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-32513](https://insights.sbomify.com/CVE-2024-32513/): WordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-32512](https://insights.sbomify.com/CVE-2024-32512/): WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability (medium 5.3)
- [CVE-2024-32511](https://insights.sbomify.com/CVE-2024-32511/): WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-32510](https://insights.sbomify.com/CVE-2024-32510/): Cross-site scripting in WP Cost Estimation & Payment Forms Builder (high 7.1)
- [CVE-2024-3251](https://insights.sbomify.com/CVE-2024-3251/): SourceCodester Computer Laboratory Management System sql injection (medium 6.3)
- [CVE-2024-32509](https://insights.sbomify.com/CVE-2024-32509/): WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32508](https://insights.sbomify.com/CVE-2024-32508/): WordPress DethemeKit For Elementor plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32507](https://insights.sbomify.com/CVE-2024-32507/): WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-32506](https://insights.sbomify.com/CVE-2024-32506/): WordPress Radio Player plugin <= 2.0.73 - Sensitive Data Exposure vulnerability (medium 5.4)
- [CVE-2024-32505](https://insights.sbomify.com/CVE-2024-32505/): WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32504](https://insights.sbomify.com/CVE-2024-32504/): Memory corruption in samsung:exynos 1080 firmware (high 8.4)
- [CVE-2024-32503](https://insights.sbomify.com/CVE-2024-32503/): Use after free in samsung:exynos 1080 firmware (high 8.4)
- [CVE-2024-32502](https://insights.sbomify.com/CVE-2024-32502/): Use after free in samsung:exynos 1080 firmware (high 8.4)
- [CVE-2024-32501](https://insights.sbomify.com/CVE-2024-32501/): SQL injection in centreon:centreon web (critical 9.8)
- [CVE-2024-3250](https://insights.sbomify.com/CVE-2024-3250/): Pebble service manager's file pull API allows access by any user (medium 6.5)
- [CVE-2024-32499](https://insights.sbomify.com/CVE-2024-32499/): Code injection in Project Center Server (medium 4.9)
- [CVE-2024-32498](https://insights.sbomify.com/CVE-2024-32498/): OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access (medium 6.5)
- [CVE-2024-32493](https://insights.sbomify.com/CVE-2024-32493/): SQL injection in znuny:znuny (high 8.8)
- [CVE-2024-32492](https://insights.sbomify.com/CVE-2024-32492/): Cross-site scripting in znuny:znuny (high 7.1)
- [CVE-2024-32491](https://insights.sbomify.com/CVE-2024-32491/): Path traversal in znuny:znuny (critical 9.8)
- [CVE-2024-3249](https://insights.sbomify.com/CVE-2024-3249/): Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modification (medium 4.3)
- [CVE-2024-32489](https://insights.sbomify.com/CVE-2024-32489/): TCPDF Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-32488](https://insights.sbomify.com/CVE-2024-32488/): Privilege escalation in foxit:pdf editor (high 7.8)
- [CVE-2024-32487](https://insights.sbomify.com/CVE-2024-32487/): Command injection in debian:debian linux (high 8.6)
- [CVE-2024-32485](https://insights.sbomify.com/CVE-2024-32485/): Denial of service in Intel(R) VROC software (low 2.4)
- [CVE-2024-32484](https://insights.sbomify.com/CVE-2024-32484/): Cross-site scripting in Anki (high 7.4)
- [CVE-2024-32483](https://insights.sbomify.com/CVE-2024-32483/): Privilege escalation in Intel(R) EMA software (high 7.0)
- [CVE-2024-32482](https://insights.sbomify.com/CVE-2024-32482/): Tillitis TKey Signer possible RAM disclosure vulnerability (low 2.2)
- [CVE-2024-32481](https://insights.sbomify.com/CVE-2024-32481/): vyper's range(start, start + N) reverts for negative numbers (medium 5.3)
- [CVE-2024-32480](https://insights.sbomify.com/CVE-2024-32480/): LibreNMS's Time-Based Blind SQL injection leads to database extraction (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/369/