Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 472 of 521.
- CVE-2024-13904 Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery
- CVE-2024-13903 quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow
- CVE-2024-13902 huang-yk student-manage Edit a Student Information Page cross site scripting
- CVE-2024-13901 Cross-site scripting in Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
- CVE-2024-13900 Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments
- CVE-2024-1390 Missing authorization in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-13899 Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection
- CVE-2024-13898 Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-13897 Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion
- CVE-2024-13896 WP-GeSHi-Highlight <= 1.4.3 - Author+ ReDoS
- CVE-2024-13895 Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2024-13894 Path traversal in Smartwares cameras
- CVE-2024-13893 Shared credentials in Smartwares cameras
- CVE-2024-13892 Command Injection in Smartwares cameras
- CVE-2024-13891 Schedule <= 1.0.0 - Reflected XSS
- CVE-2024-13890 Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection
- CVE-2024-1389 Missing authorization in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-13889 WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection
- CVE-2024-13888 WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter
- CVE-2024-13887 Missing authorization in Business Directory Plugin – Easy Listing Directories for WordPress
- CVE-2024-13885 WP E Customers <= 0.0.1 - Reflected XSS
- CVE-2024-13884 Limit Bio <= 1.0 - Reflected XSS
- CVE-2024-13883 WPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Update
- CVE-2024-13882 File upload in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
- CVE-2024-13881 LinkMyPosts <= 1.0 - Reflected XSS
- CVE-2024-13880 My Quota <= 1.0.8 - Reflected XSS
- CVE-2024-1388 Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset
- CVE-2024-13879 Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery
- CVE-2024-13878 SpotBot <= 0.1.8 - Reflected XSS
- CVE-2024-13877 Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS
- CVE-2024-13876 Meintopf <= 0.2.1 - Reflected XSS
- CVE-2024-13875 WP Programmmanager <= 1.2 - Reflected XSS
- CVE-2024-13874 Feedify – Web Push Notifications < 2.4.6 - Reflected XSS
- CVE-2024-13873 WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
- CVE-2024-13872 Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so
- CVE-2024-13871 Unauthenticated Command Injection in Bitdefender BOX v1
- CVE-2024-13870 Unauthenticated Firmware Downgrade in Bitdefender Box v1
- CVE-2024-1387 Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure
- CVE-2024-13869 Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
- CVE-2024-13868 Easy Broken Link Checker <= 9.0.2 - Reflected XSS
- CVE-2024-13867 Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting
- CVE-2024-13866 Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-13865 drm-protected-video-streaming <= 4.2.1 - Reflected XSS
- CVE-2024-13864 Countdown Timer <= 1.0 - Reflected XSS
- CVE-2024-13863 Stylish Google Sheet Reader < 4.1 - Reflected XSS
- CVE-2024-13862 S3Bubble Media Streaming <= 8.0 - Reflected XSS
- CVE-2024-13861 Code injection in Taegis Endpoint Agent (Linux)
- CVE-2024-13860 BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title'
- CVE-2024-1386 Cross-site scripting in MailerLite – Signup forms (official)
- CVE-2024-13859 Cross-site scripting in BuddyBoss Platform
- CVE-2024-13858 Cross-site scripting in BuddyBoss Platform
- CVE-2024-13857 WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery
- CVE-2024-13856 Server-side request forgery in Your Friendly Drag and Drop Page Builder — Make Builder
- CVE-2024-13855 Missing authorization in Prime Addons for Elementor
- CVE-2024-13854 Missing authorization in Education Addon for Elementor
- CVE-2024-13853 SEO Tools <= 4.0.7 - Reflected XSS
- CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update
- CVE-2024-13851 Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-13850 Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-1385 WP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update
- CVE-2024-13849 Cookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-13848 Reaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-13846 Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter
- CVE-2024-13845 Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
- CVE-2024-13844 Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
- CVE-2024-13843 Information disclosure in Connect Secure
- CVE-2024-13842 Hardcoded credentials in Connect Secure
- CVE-2024-13841 Information disclosure in Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time
- CVE-2024-1384 Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13839 Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function
- CVE-2024-13838 Server-side request forgery in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin
- CVE-2024-13836 WP Login Control <= 2.0.0 - Reflected XSS
- CVE-2024-13835 Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
- CVE-2024-13834 Server-side request forgery in Responsive Plus – Elementor Templates & Starter Sites
- CVE-2024-13833 Album Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta
- CVE-2024-13832 Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure
- CVE-2024-13831 Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs
- CVE-2024-13830 Cross-site scripting in Connect Secure
- CVE-2024-1383 WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting
- CVE-2024-13829 Information disclosure in WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
- CVE-2024-13828 Badgearoo <= 1.0.14 - Reflected XSS
- CVE-2024-13827 Cross-site scripting in Razorpay Subscription Button Elementor Plugin
- CVE-2024-13826 Email Keep <= 1.1 - Email Deletion via CSRF
- CVE-2024-13825 Email Keep <= 1.1 - Reflected XSS
- CVE-2024-13824 CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection
- CVE-2024-13823 360 Product Rotation <= 1.5.8 - Reflected XSS
- CVE-2024-13822 Total Contest Lite <= 2.8.1 - Reflected XSS
- CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
- CVE-2024-13820 Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash
- CVE-2024-1382 Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion
- CVE-2024-13818 Information disclosure in Pie Register – User Registration, Profiles & Content Restriction
- CVE-2024-13816 Missing authorization in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit
- CVE-2024-13815 Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13814 Global Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2024-13813 Misconfiguration in Secure Access Client
- CVE-2024-13812 Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13811 Missing authorization in Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme
- CVE-2024-13810 Missing authorization in Zass - WooCommerce Theme for Handmade Artists and Artisans
- CVE-2024-1381 Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure
- CVE-2024-13809 Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection