# Vulnerabilities published in 2024


- [CVE-2024-31310](https://insights.sbomify.com/CVE-2024-31310/): Security feature bypass in Android (high 7.8)
- [CVE-2024-3131](https://insights.sbomify.com/CVE-2024-3131/): SourceCodester Computer Laboratory Management System sql injection (medium 6.3)
- [CVE-2024-31309](https://insights.sbomify.com/CVE-2024-31309/): Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack (high 7.5)
- [CVE-2024-31308](https://insights.sbomify.com/CVE-2024-31308/): WordPress WP Import Export Lite & WP Import Export plugin <= 3.9.26 - PHP Object Injection vulnerability (medium 4.4)
- [CVE-2024-31307](https://insights.sbomify.com/CVE-2024-31307/): WordPress Easy Social Share Buttons plugin <= 9.4 - Multiple Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-31306](https://insights.sbomify.com/CVE-2024-31306/): WordPress Essential Blocks plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31305](https://insights.sbomify.com/CVE-2024-31305/): WordPress Transcoder plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31304](https://insights.sbomify.com/CVE-2024-31304/): WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-31303](https://insights.sbomify.com/CVE-2024-31303/): WordPress Sign-up Sheets plugin <= 2.2.11.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31302](https://insights.sbomify.com/CVE-2024-31302/): WordPress Contact Form Email plugin <= 1.3.44 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-31301](https://insights.sbomify.com/CVE-2024-31301/): WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31300](https://insights.sbomify.com/CVE-2024-31300/): WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-3130](https://insights.sbomify.com/CVE-2024-3130/): Insecure Data Storage leading to sensitive Information disclosure. (medium 5.7)
- [CVE-2024-31299](https://insights.sbomify.com/CVE-2024-31299/): WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-31298](https://insights.sbomify.com/CVE-2024-31298/): WordPress User Spam Remover plugin <= 1.0 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-31297](https://insights.sbomify.com/CVE-2024-31297/): WordPress Wholesale For WooCommerce plugin <= 2.3.1 - Unauthenticated Arbitrary Post/Page vulnerability (high 7.5)
- [CVE-2024-31296](https://insights.sbomify.com/CVE-2024-31296/): WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-31295](https://insights.sbomify.com/CVE-2024-31295/): WordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerability (medium 5.3)
- [CVE-2024-31294](https://insights.sbomify.com/CVE-2024-31294/): WordPress WP Sort Order plugin <= 1.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31293](https://insights.sbomify.com/CVE-2024-31293/): WordPress Easy Digital Downloads plugin <= 3.2.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31292](https://insights.sbomify.com/CVE-2024-31292/): WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2024-31291](https://insights.sbomify.com/CVE-2024-31291/): WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability (medium 4.3)
- [CVE-2024-31290](https://insights.sbomify.com/CVE-2024-31290/): WordPress Demo My WordPress plugin <= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-3129](https://insights.sbomify.com/CVE-2024-3129/): SourceCodester Image Accordion Gallery App add-image.php unrestricted upload (medium 6.3)
- [CVE-2024-31289](https://insights.sbomify.com/CVE-2024-31289/): WordPress Hello Elementor theme <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31288](https://insights.sbomify.com/CVE-2024-31288/): WordPress RapidLoad plugin <= 2.2.11 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2024-31287](https://insights.sbomify.com/CVE-2024-31287/): WordPress Media Library Folders plugin <= 8.1.8 - Directory Traversal vulnerability (medium 6.5)
- [CVE-2024-31286](https://insights.sbomify.com/CVE-2024-31286/): WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-31285](https://insights.sbomify.com/CVE-2024-31285/): WordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2024-31284](https://insights.sbomify.com/CVE-2024-31284/): WordPress EmbedPress plugin <= 3.9.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-31283](https://insights.sbomify.com/CVE-2024-31283/): WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-31282](https://insights.sbomify.com/CVE-2024-31282/): WordPress App Builder plugin <= 3.8.7 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-31281](https://insights.sbomify.com/CVE-2024-31281/): WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-31280](https://insights.sbomify.com/CVE-2024-31280/): WordPress Church Admin plugin <= 4.1.5 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-3128](https://insights.sbomify.com/CVE-2024-3128/): Replify-Messenger Backup File androidmanifest.xml backup (low 2.4)
- [CVE-2024-31279](https://insights.sbomify.com/CVE-2024-31279/): WordPress Generate Child Theme plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31278](https://insights.sbomify.com/CVE-2024-31278/): WordPress Premium Addons for Elementor plugin <= 4.10.22 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-31277](https://insights.sbomify.com/CVE-2024-31277/): WordPress Product Designer plugin <= 1.0.32 - PHP Object Injection vulnerability (high 8.7)
- [CVE-2024-31276](https://insights.sbomify.com/CVE-2024-31276/): WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-31275](https://insights.sbomify.com/CVE-2024-31275/): WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability (high 8.2)
- [CVE-2024-31274](https://insights.sbomify.com/CVE-2024-31274/): WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-31273](https://insights.sbomify.com/CVE-2024-31273/): WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-31272](https://insights.sbomify.com/CVE-2024-31272/): WordPress ARForms Form Builder plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.3)
- [CVE-2024-31271](https://insights.sbomify.com/CVE-2024-31271/): WordPress Ultimate Maps plugin <= 1.2.16 - Cross Site Request Forgery vulnerability (medium 4.3)
- [CVE-2024-31270](https://insights.sbomify.com/CVE-2024-31270/): WordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerability (high 7.6)
- [CVE-2024-3127](https://insights.sbomify.com/CVE-2024-3127/): Improper Access Control in GitLab (medium 4.3)
- [CVE-2024-31269](https://insights.sbomify.com/CVE-2024-31269/): WordPress Easy Google Maps plugin <= 1.11.11 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31268](https://insights.sbomify.com/CVE-2024-31268/): WordPress AppPresser plugin <= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31267](https://insights.sbomify.com/CVE-2024-31267/): WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31266](https://insights.sbomify.com/CVE-2024-31266/): WordPress Advanced Order Export For WooCommerce plugin <= 3.4.4 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-31265](https://insights.sbomify.com/CVE-2024-31265/): WordPress Sumo plugin <= 1.34 - Cross Site Request Forgery (CSRF) vulnerability (low 3.7)
- [CVE-2024-31264](https://insights.sbomify.com/CVE-2024-31264/): WordPress Post Views Counter plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31263](https://insights.sbomify.com/CVE-2024-31263/): Cross-site request forgery in Loan Repayment Calculator and Application Form (medium 5.4)
- [CVE-2024-31262](https://insights.sbomify.com/CVE-2024-31262/): Cross-site request forgery in WooCommerce Checkout Field Editor (Checkout Manager) (medium 5.4)
- [CVE-2024-31261](https://insights.sbomify.com/CVE-2024-31261/): WordPress Announcer – Notification & message bars plugin <= 6.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31260](https://insights.sbomify.com/CVE-2024-31260/): WordPress Edwiser Bridge plugin <= 3.0.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-3126](https://insights.sbomify.com/CVE-2024-3126/): Command Injection in parisneo/lollms-webui (high 8.4)
- [CVE-2024-31259](https://insights.sbomify.com/CVE-2024-31259/): WordPress SearchIQ plugin <= 4.5 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-31258](https://insights.sbomify.com/CVE-2024-31258/): WordPress Form to Chat App plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31257](https://insights.sbomify.com/CVE-2024-31257/): WordPress Formsite plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31256](https://insights.sbomify.com/CVE-2024-31256/): WordPress WebinarPress plugin <= 1.33.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31255](https://insights.sbomify.com/CVE-2024-31255/): WordPress ELEX WooCommerce Dynamic Pricing and Discounts plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31254](https://insights.sbomify.com/CVE-2024-31254/): WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability (low 3.7)
- [CVE-2024-31253](https://insights.sbomify.com/CVE-2024-31253/): WordPress WP OAuth Server (OAuth Authentication) plugin <= 4.3.3 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-31252](https://insights.sbomify.com/CVE-2024-31252/): WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31251](https://insights.sbomify.com/CVE-2024-31251/): WordPress Community by PeepSo plugin <= 6.3.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31250](https://insights.sbomify.com/CVE-2024-31250/): WordPress WP Server Health Stats plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3125](https://insights.sbomify.com/CVE-2024-3125/): Zebra ZTC GK420d Alert Setup Page settings cross site scripting (low 2.4)
- [CVE-2024-31249](https://insights.sbomify.com/CVE-2024-31249/): WordPress Subscribe To Comments Reloaded plugin <= 220725 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-31248](https://insights.sbomify.com/CVE-2024-31248/): WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31247](https://insights.sbomify.com/CVE-2024-31247/): WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-31246](https://insights.sbomify.com/CVE-2024-31246/): WordPress PostX plugin <= 3.2.3 - Author+ Post/Page Duplication vulnerability (medium 5.4)
- [CVE-2024-31245](https://insights.sbomify.com/CVE-2024-31245/): WordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerability (medium 5.3)
- [CVE-2024-31244](https://insights.sbomify.com/CVE-2024-31244/): WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability (critical 9.8)
- [CVE-2024-31243](https://insights.sbomify.com/CVE-2024-31243/): WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability (high 7.5)
- [CVE-2024-31242](https://insights.sbomify.com/CVE-2024-31242/): WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability (medium 5.3)
- [CVE-2024-31241](https://insights.sbomify.com/CVE-2024-31241/): WordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-31240](https://insights.sbomify.com/CVE-2024-31240/): WordPress WP Poll Maker plugin <= 3.1 - Auth. Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2024-3124](https://insights.sbomify.com/CVE-2024-3124/): fridgecow smartalarm Backup File androidmanifest.xml backup (low 2.4)
- [CVE-2024-31239](https://insights.sbomify.com/CVE-2024-31239/): WordPress Nudgify Social Proof, Sales Popup & FOMO plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31238](https://insights.sbomify.com/CVE-2024-31238/): WordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31237](https://insights.sbomify.com/CVE-2024-31237/): WordPress s2Member plugin <= 240315 - Privilege Escalation vulnerability (high 7.5)
- [CVE-2024-31236](https://insights.sbomify.com/CVE-2024-31236/): WordPress Royal Elementor Addons plugin <= 1.3.93 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31235](https://insights.sbomify.com/CVE-2024-31235/): WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31234](https://insights.sbomify.com/CVE-2024-31234/): WordPress REHub Framework plugin < 19.6.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-31233](https://insights.sbomify.com/CVE-2024-31233/): WordPress Rehub theme <= 19.6.1 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-31232](https://insights.sbomify.com/CVE-2024-31232/): WordPress Rehub theme <= 19.6.1 - Local File Inclusion vulnerability (high 8.0)
- [CVE-2024-31231](https://insights.sbomify.com/CVE-2024-31231/): WordPress Rehub theme <= 19.6.1 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-31230](https://insights.sbomify.com/CVE-2024-31230/): WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-3123](https://insights.sbomify.com/CVE-2024-3123/): CHANGING Mobile One Time Password - Arbitrary File Upload (high 7.2)
- [CVE-2024-31229](https://insights.sbomify.com/CVE-2024-31229/): WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability (medium 5.5)
- [CVE-2024-31228](https://insights.sbomify.com/CVE-2024-31228/): Denial-of-service due to unbounded pattern matching in Redis (medium 5.5)
- [CVE-2024-31227](https://insights.sbomify.com/CVE-2024-31227/): Denial-of-service due to malformed ACL selectors in Redis (medium 4.4)
- [CVE-2024-31226](https://insights.sbomify.com/CVE-2024-31226/): Sunshine's unquoted executable path could lead to hijacked execution flow (medium 4.9)
- [CVE-2024-31225](https://insights.sbomify.com/CVE-2024-31225/): Lack of size check and buffer overflow in RIOT (high 8.4)
- [CVE-2024-31224](https://insights.sbomify.com/CVE-2024-31224/): GPT Academic: Pickle deserializing cookies may pose RCE risk (critical 9.8)
- [CVE-2024-31223](https://insights.sbomify.com/CVE-2024-31223/): Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL (medium 5.3)
- [CVE-2024-31221](https://insights.sbomify.com/CVE-2024-31221/): Clients removed during unpairing process may regain access if Sunshine was not restarted (medium 5.9)
- [CVE-2024-31220](https://insights.sbomify.com/CVE-2024-31220/): Sunshine vulnerable to remote unauthenticated arbitrary file read (high 7.3)
- [CVE-2024-3122](https://insights.sbomify.com/CVE-2024-3122/): CHANGING Mobile One Time Password - Arbitrary File Reading (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/378/