# Vulnerabilities published in 2024


- [CVE-2024-30536](https://insights.sbomify.com/CVE-2024-30536/): WordPress Slugs Manager plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30535](https://insights.sbomify.com/CVE-2024-30535/): WordPress Easy Form Builder plugin <= 3.7.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30534](https://insights.sbomify.com/CVE-2024-30534/): WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30533](https://insights.sbomify.com/CVE-2024-30533/): WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability (high 7.5)
- [CVE-2024-30532](https://insights.sbomify.com/CVE-2024-30532/): WordPress Builderall Builder for WordPress plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-30531](https://insights.sbomify.com/CVE-2024-30531/): WordPress Nelio Content plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-30530](https://insights.sbomify.com/CVE-2024-30530/): Cross-site scripting in MP3 Audio Player for Music, Radio & Podcast by Sonaar (medium 6.5)
- [CVE-2024-3053](https://insights.sbomify.com/CVE-2024-3053/): Cross-site scripting in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 6.4)
- [CVE-2024-30529](https://insights.sbomify.com/CVE-2024-30529/): WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30528](https://insights.sbomify.com/CVE-2024-30528/): WordPress Spiffy Calendar plugin <= 4.9.10 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-30527](https://insights.sbomify.com/CVE-2024-30527/): WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability (high 7.5)
- [CVE-2024-30526](https://insights.sbomify.com/CVE-2024-30526/): Cross-site request forgery in Easy Social Feed (medium 4.3)
- [CVE-2024-30525](https://insights.sbomify.com/CVE-2024-30525/): WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30524](https://insights.sbomify.com/CVE-2024-30524/): WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30523](https://insights.sbomify.com/CVE-2024-30523/): WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-30522](https://insights.sbomify.com/CVE-2024-30522/): WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability (medium 5.3)
- [CVE-2024-30521](https://insights.sbomify.com/CVE-2024-30521/): WordPress Landingi Landing Pages plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-30520](https://insights.sbomify.com/CVE-2024-30520/): WordPress Carousel Anything For WPBakery Page Builder plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3052](https://insights.sbomify.com/CVE-2024-3052/): Z/IP Gateway S2 Nonce Get Denial of Service Vulnerability (high 7.5)
- [CVE-2024-30519](https://insights.sbomify.com/CVE-2024-30519/): WordPress Lordicon Animated Icons plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30518](https://insights.sbomify.com/CVE-2024-30518/): WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30517](https://insights.sbomify.com/CVE-2024-30517/): WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-30516](https://insights.sbomify.com/CVE-2024-30516/): WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability (high 7.5)
- [CVE-2024-30515](https://insights.sbomify.com/CVE-2024-30515/): WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-30514](https://insights.sbomify.com/CVE-2024-30514/): Information disclosure in Paid Memberships Pro – Payfast Gateway Add On (medium 5.3)
- [CVE-2024-30513](https://insights.sbomify.com/CVE-2024-30513/): WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2024-30512](https://insights.sbomify.com/CVE-2024-30512/): WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability (low 3.7)
- [CVE-2024-30511](https://insights.sbomify.com/CVE-2024-30511/): WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-30510](https://insights.sbomify.com/CVE-2024-30510/): WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-3051](https://insights.sbomify.com/CVE-2024-3051/): Z/IP Gateway Device Reset Locally Denial of Service Vulnerability (high 7.5)
- [CVE-2024-30509](https://insights.sbomify.com/CVE-2024-30509/): WordPress SellKit plugin <= 1.8.1 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2024-30508](https://insights.sbomify.com/CVE-2024-30508/): WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30507](https://insights.sbomify.com/CVE-2024-30507/): WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability (low 2.7)
- [CVE-2024-30506](https://insights.sbomify.com/CVE-2024-30506/): WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30505](https://insights.sbomify.com/CVE-2024-30505/): WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-30504](https://insights.sbomify.com/CVE-2024-30504/): WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-30503](https://insights.sbomify.com/CVE-2024-30503/): WordPress Mailster plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30502](https://insights.sbomify.com/CVE-2024-30502/): WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability (critical 9.3)
- [CVE-2024-30501](https://insights.sbomify.com/CVE-2024-30501/): WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-30500](https://insights.sbomify.com/CVE-2024-30500/): WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-3050](https://insights.sbomify.com/CVE-2024-3050/): Site Reviews < 7.0.0 - IP Spoofing (critical 9.1)
- [CVE-2024-30499](https://insights.sbomify.com/CVE-2024-30499/): WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30498](https://insights.sbomify.com/CVE-2024-30498/): WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-30497](https://insights.sbomify.com/CVE-2024-30497/): WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30496](https://insights.sbomify.com/CVE-2024-30496/): WordPress Element Pack Lite plugin <= 5.5.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30495](https://insights.sbomify.com/CVE-2024-30495/): WordPress Falang multilanguage for WordPress plugin <= 1.3.47 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-30494](https://insights.sbomify.com/CVE-2024-30494/): WordPress OSS Aliyun plugin <= 1.4.10 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-30493](https://insights.sbomify.com/CVE-2024-30493/): WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30492](https://insights.sbomify.com/CVE-2024-30492/): WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability (medium 4.3)
- [CVE-2024-30491](https://insights.sbomify.com/CVE-2024-30491/): SQL injection in ProfileGrid (high 8.5)
- [CVE-2024-30490](https://insights.sbomify.com/CVE-2024-30490/): WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-3049](https://insights.sbomify.com/CVE-2024-3049/): Booth: specially crafted hash can lead to invalid hmac being accepted by booth server (medium 5.9)
- [CVE-2024-30489](https://insights.sbomify.com/CVE-2024-30489/): WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30488](https://insights.sbomify.com/CVE-2024-30488/): WordPress Zotpress plugin <= 7.3.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30487](https://insights.sbomify.com/CVE-2024-30487/): WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerability (high 7.6)
- [CVE-2024-30486](https://insights.sbomify.com/CVE-2024-30486/): WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-30485](https://insights.sbomify.com/CVE-2024-30485/): WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability (high 8.8)
- [CVE-2024-30484](https://insights.sbomify.com/CVE-2024-30484/): WordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-30483](https://insights.sbomify.com/CVE-2024-30483/): WordPress Sponsors plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30482](https://insights.sbomify.com/CVE-2024-30482/): WordPress Simple Revisions Delete plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30481](https://insights.sbomify.com/CVE-2024-30481/): WordPress JCH Optimize plugin <= 4.0.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30480](https://insights.sbomify.com/CVE-2024-30480/): WordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerability (low 3.7)
- [CVE-2024-3048](https://insights.sbomify.com/CVE-2024-3048/): Bannerlid <= 1.1.0 - Reflected XSS (medium 5.5)
- [CVE-2024-30479](https://insights.sbomify.com/CVE-2024-30479/): WordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability (medium 5.3)
- [CVE-2024-30478](https://insights.sbomify.com/CVE-2024-30478/): WordPress Announcement & Notification Banner – Bulletin plugin <= 3.8.5 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-30477](https://insights.sbomify.com/CVE-2024-30477/): WordPress Klarna Payments for WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30476](https://insights.sbomify.com/CVE-2024-30476/): Cross-site scripting in PowerStore (medium 5.4)
- [CVE-2024-30473](https://insights.sbomify.com/CVE-2024-30473/): Privilege escalation in ECS (medium 4.9)
- [CVE-2024-30472](https://insights.sbomify.com/CVE-2024-30472/): Information disclosure in Wyse 5070 Thin Client (high 7.5)
- [CVE-2024-30471](https://insights.sbomify.com/CVE-2024-30471/): Apache StreamPipes: Potential creation of multiple identical accounts (medium 5.3)
- [CVE-2024-30470](https://insights.sbomify.com/CVE-2024-30470/): WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-3047](https://insights.sbomify.com/CVE-2024-3047/): PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery (high 7.2)
- [CVE-2024-30469](https://insights.sbomify.com/CVE-2024-30469/): WordPress Wholesale For WooCommerce plugin <= 2.3.0 - Unauthenticated Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-30468](https://insights.sbomify.com/CVE-2024-30468/): Cross-site request forgery in All In One WP Security & Firewall (medium 4.3)
- [CVE-2024-30467](https://insights.sbomify.com/CVE-2024-30467/): WordPress Essential Blocks plugin <= 4.4.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30466](https://insights.sbomify.com/CVE-2024-30466/): WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-30465](https://insights.sbomify.com/CVE-2024-30465/): WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30464](https://insights.sbomify.com/CVE-2024-30464/): WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-30463](https://insights.sbomify.com/CVE-2024-30463/): WordPress BEAR plugin <= 1.1.4.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-30462](https://insights.sbomify.com/CVE-2024-30462/): WordPress HUSKY plugin <= 1.3.5.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30461](https://insights.sbomify.com/CVE-2024-30461/): WordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-30460](https://insights.sbomify.com/CVE-2024-30460/): WordPress Tumult Hype Animations plugin <= 1.9.11 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3046](https://insights.sbomify.com/CVE-2024-3046/): Eclipse Kura LogServlet vulnerability (high 7.5)
- [CVE-2024-30459](https://insights.sbomify.com/CVE-2024-30459/): WordPress AI WP Writer plugin <= 3.6.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-30458](https://insights.sbomify.com/CVE-2024-30458/): Cross-site request forgery in WOOCS – WooCommerce Currency Switcher (medium 4.3)
- [CVE-2024-30457](https://insights.sbomify.com/CVE-2024-30457/): WordPress MDTF plugin <= 1.3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30456](https://insights.sbomify.com/CVE-2024-30456/): Cross-site request forgery in WPCS (medium 4.3)
- [CVE-2024-30455](https://insights.sbomify.com/CVE-2024-30455/): WordPress GamiPress plugin <= 6.8.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30454](https://insights.sbomify.com/CVE-2024-30454/): WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-30453](https://insights.sbomify.com/CVE-2024-30453/): WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-30452](https://insights.sbomify.com/CVE-2024-30452/): WordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30451](https://insights.sbomify.com/CVE-2024-30451/): WordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30450](https://insights.sbomify.com/CVE-2024-30450/): Cross-site scripting in OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) (medium 6.5)
- [CVE-2024-3045](https://insights.sbomify.com/CVE-2024-3045/): PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-30449](https://insights.sbomify.com/CVE-2024-30449/): WordPress Booking Activities plugin <= 1.15.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30448](https://insights.sbomify.com/CVE-2024-30448/): WordPress Slider by Supsystic plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30447](https://insights.sbomify.com/CVE-2024-30447/): WordPress Creative Image Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30446](https://insights.sbomify.com/CVE-2024-30446/): WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30445](https://insights.sbomify.com/CVE-2024-30445/): WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30444](https://insights.sbomify.com/CVE-2024-30444/): WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/383/