# Vulnerabilities published in 2024


- [CVE-2024-13904](https://insights.sbomify.com/CVE-2024-13904/): Platform.ly for WooCommerce <= 1.1.6 - Unauthenticated Blind Server-Side Request Forgery (medium 5.3)
- [CVE-2024-13903](https://insights.sbomify.com/CVE-2024-13903/): quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow (medium 5.3)
- [CVE-2024-13902](https://insights.sbomify.com/CVE-2024-13902/): huang-yk student-manage Edit a Student Information Page cross site scripting (medium 4.8)
- [CVE-2024-13901](https://insights.sbomify.com/CVE-2024-13901/): Cross-site scripting in Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress (medium 4.4)
- [CVE-2024-13900](https://insights.sbomify.com/CVE-2024-13900/): Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments (medium 4.1)
- [CVE-2024-1390](https://insights.sbomify.com/CVE-2024-1390/): Missing authorization in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (medium 4.3)
- [CVE-2024-13899](https://insights.sbomify.com/CVE-2024-13899/): Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection (high 7.2)
- [CVE-2024-13898](https://insights.sbomify.com/CVE-2024-13898/): Simple Banner <= 3.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-13897](https://insights.sbomify.com/CVE-2024-13897/): Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion (medium 6.5)
- [CVE-2024-13896](https://insights.sbomify.com/CVE-2024-13896/): WP-GeSHi-Highlight <= 1.4.3 - Author+ ReDoS (medium 6.5)
- [CVE-2024-13895](https://insights.sbomify.com/CVE-2024-13895/): Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (medium 4.3)
- [CVE-2024-13894](https://insights.sbomify.com/CVE-2024-13894/): Path traversal in Smartwares cameras (medium 5.9)
- [CVE-2024-13893](https://insights.sbomify.com/CVE-2024-13893/): Shared credentials in Smartwares cameras (high 7.5)
- [CVE-2024-13892](https://insights.sbomify.com/CVE-2024-13892/): Command Injection in Smartwares cameras (high 7.7)
- [CVE-2024-13891](https://insights.sbomify.com/CVE-2024-13891/): Schedule <= 1.0.0 - Reflected XSS (high 7.1)
- [CVE-2024-13890](https://insights.sbomify.com/CVE-2024-13890/): Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection (high 7.2)
- [CVE-2024-1389](https://insights.sbomify.com/CVE-2024-1389/): Missing authorization in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (medium 5.3)
- [CVE-2024-13889](https://insights.sbomify.com/CVE-2024-13889/): WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection (high 7.2)
- [CVE-2024-13888](https://insights.sbomify.com/CVE-2024-13888/): WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter (high 7.2)
- [CVE-2024-13887](https://insights.sbomify.com/CVE-2024-13887/): Missing authorization in Business Directory Plugin – Easy Listing Directories for WordPress (medium 5.3)
- [CVE-2024-13885](https://insights.sbomify.com/CVE-2024-13885/): WP E Customers <= 0.0.1 - Reflected XSS (high 7.1)
- [CVE-2024-13884](https://insights.sbomify.com/CVE-2024-13884/): Limit Bio <= 1.0 - Reflected XSS (high 7.1)
- [CVE-2024-13883](https://insights.sbomify.com/CVE-2024-13883/): WPUpper Share Buttons <= 3.51 - Cross-Site Request Forgery to Custom CSS Update (medium 4.3)
- [CVE-2024-13882](https://insights.sbomify.com/CVE-2024-13882/): File upload in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit (high 8.8)
- [CVE-2024-13881](https://insights.sbomify.com/CVE-2024-13881/): LinkMyPosts <= 1.0 - Reflected XSS (high 7.1)
- [CVE-2024-13880](https://insights.sbomify.com/CVE-2024-13880/): My Quota <= 1.0.8 - Reflected XSS (high 7.1)
- [CVE-2024-1388](https://insights.sbomify.com/CVE-2024-1388/): Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset (medium 4.3)
- [CVE-2024-13879](https://insights.sbomify.com/CVE-2024-13879/): Stream <= 4.0.2 - Authenticated (Admin+) Server-Side Request Forgery (medium 5.5)
- [CVE-2024-13878](https://insights.sbomify.com/CVE-2024-13878/): SpotBot <= 0.1.8 - Reflected XSS (high 7.1)
- [CVE-2024-13877](https://insights.sbomify.com/CVE-2024-13877/): Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS (high 7.1)
- [CVE-2024-13876](https://insights.sbomify.com/CVE-2024-13876/): Meintopf <= 0.2.1 - Reflected XSS (high 7.1)
- [CVE-2024-13875](https://insights.sbomify.com/CVE-2024-13875/): WP Programmmanager <= 1.2 - Reflected XSS (high 7.1)
- [CVE-2024-13874](https://insights.sbomify.com/CVE-2024-13874/): Feedify – Web Push Notifications < 2.4.6 - Reflected XSS (high 7.1)
- [CVE-2024-13873](https://insights.sbomify.com/CVE-2024-13873/): WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection (medium 4.3)
- [CVE-2024-13872](https://insights.sbomify.com/CVE-2024-13872/): Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so (critical 9.4)
- [CVE-2024-13871](https://insights.sbomify.com/CVE-2024-13871/): Unauthenticated Command Injection in Bitdefender BOX v1 (critical 9.4)
- [CVE-2024-13870](https://insights.sbomify.com/CVE-2024-13870/): Unauthenticated Firmware Downgrade in Bitdefender Box v1 (low 1.8)
- [CVE-2024-1387](https://insights.sbomify.com/CVE-2024-1387/): Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure (medium 4.3)
- [CVE-2024-13869](https://insights.sbomify.com/CVE-2024-13869/): Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file (high 7.2)
- [CVE-2024-13868](https://insights.sbomify.com/CVE-2024-13868/): Easy Broken Link Checker <= 9.0.2 - Reflected XSS (medium 6.1)
- [CVE-2024-13867](https://insights.sbomify.com/CVE-2024-13867/): Listivo - Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13866](https://insights.sbomify.com/CVE-2024-13866/): Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13865](https://insights.sbomify.com/CVE-2024-13865/): drm-protected-video-streaming <= 4.2.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13864](https://insights.sbomify.com/CVE-2024-13864/): Countdown Timer <= 1.0 - Reflected XSS (high 7.1)
- [CVE-2024-13863](https://insights.sbomify.com/CVE-2024-13863/): Stylish Google Sheet Reader < 4.1 - Reflected XSS (high 7.1)
- [CVE-2024-13862](https://insights.sbomify.com/CVE-2024-13862/): S3Bubble Media Streaming <= 8.0 - Reflected XSS (high 7.1)
- [CVE-2024-13861](https://insights.sbomify.com/CVE-2024-13861/): Code injection in Taegis Endpoint Agent (Linux) (high 7.8)
- [CVE-2024-13860](https://insights.sbomify.com/CVE-2024-13860/): BuddyBoss Platform <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'bbp_topic_title' (medium 6.4)
- [CVE-2024-1386](https://insights.sbomify.com/CVE-2024-1386/): Cross-site scripting in MailerLite – Signup forms (official) (medium 6.4)
- [CVE-2024-13859](https://insights.sbomify.com/CVE-2024-13859/): Cross-site scripting in BuddyBoss Platform (medium 6.4)
- [CVE-2024-13858](https://insights.sbomify.com/CVE-2024-13858/): Cross-site scripting in BuddyBoss Platform (medium 6.4)
- [CVE-2024-13857](https://insights.sbomify.com/CVE-2024-13857/): WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery (medium 5.5)
- [CVE-2024-13856](https://insights.sbomify.com/CVE-2024-13856/): Server-side request forgery in Your Friendly Drag and Drop Page Builder — Make Builder (medium 6.4)
- [CVE-2024-13855](https://insights.sbomify.com/CVE-2024-13855/): Missing authorization in Prime Addons for Elementor (medium 4.3)
- [CVE-2024-13854](https://insights.sbomify.com/CVE-2024-13854/): Missing authorization in Education Addon for Elementor (medium 4.3)
- [CVE-2024-13853](https://insights.sbomify.com/CVE-2024-13853/): SEO Tools <= 4.0.7 - Reflected XSS (medium 6.1)
- [CVE-2024-13852](https://insights.sbomify.com/CVE-2024-13852/): Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2024-13851](https://insights.sbomify.com/CVE-2024-13851/): Modal Portfolio <= 1.7.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-13850](https://insights.sbomify.com/CVE-2024-13850/): Simple add pages or posts <= 2.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-1385](https://insights.sbomify.com/CVE-2024-1385/): WP-Stateless – Google Cloud Storage <= 3.4.0 - Missing Authorization to Limited Arbitrary Options Update (high 7.1)
- [CVE-2024-13849](https://insights.sbomify.com/CVE-2024-13849/): Cookie Notice Bar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-13848](https://insights.sbomify.com/CVE-2024-13848/): Reaction Buttons <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-13846](https://insights.sbomify.com/CVE-2024-13846/): Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter (medium 4.9)
- [CVE-2024-13845](https://insights.sbomify.com/CVE-2024-13845/): Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook (medium 5.5)
- [CVE-2024-13844](https://insights.sbomify.com/CVE-2024-13844/): Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter (medium 4.9)
- [CVE-2024-13843](https://insights.sbomify.com/CVE-2024-13843/): Information disclosure in Connect Secure (medium 6.0)
- [CVE-2024-13842](https://insights.sbomify.com/CVE-2024-13842/): Hardcoded credentials in Connect Secure (medium 6.0)
- [CVE-2024-13841](https://insights.sbomify.com/CVE-2024-13841/): Information disclosure in Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time (medium 4.3)
- [CVE-2024-1384](https://insights.sbomify.com/CVE-2024-1384/): Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13839](https://insights.sbomify.com/CVE-2024-13839/): Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function (medium 6.1)
- [CVE-2024-13838](https://insights.sbomify.com/CVE-2024-13838/): Server-side request forgery in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin (medium 5.5)
- [CVE-2024-13836](https://insights.sbomify.com/CVE-2024-13836/): WP Login Control <= 2.0.0 - Reflected XSS (high 7.1)
- [CVE-2024-13835](https://insights.sbomify.com/CVE-2024-13835/): Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation (high 7.2)
- [CVE-2024-13834](https://insights.sbomify.com/CVE-2024-13834/): Server-side request forgery in Responsive Plus – Elementor Templates & Starter Sites (medium 5.4)
- [CVE-2024-13833](https://insights.sbomify.com/CVE-2024-13833/): Album Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta (high 7.2)
- [CVE-2024-13832](https://insights.sbomify.com/CVE-2024-13832/): Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure (medium 4.3)
- [CVE-2024-13831](https://insights.sbomify.com/CVE-2024-13831/): Tabs for WooCommerce <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs (high 7.2)
- [CVE-2024-13830](https://insights.sbomify.com/CVE-2024-13830/): Cross-site scripting in Connect Secure (medium 6.1)
- [CVE-2024-1383](https://insights.sbomify.com/CVE-2024-1383/): WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13829](https://insights.sbomify.com/CVE-2024-13829/): Information disclosure in WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto (medium 5.3)
- [CVE-2024-13828](https://insights.sbomify.com/CVE-2024-13828/): Badgearoo <= 1.0.14 - Reflected XSS (medium 6.1)
- [CVE-2024-13827](https://insights.sbomify.com/CVE-2024-13827/): Cross-site scripting in Razorpay Subscription Button Elementor Plugin (medium 6.1)
- [CVE-2024-13826](https://insights.sbomify.com/CVE-2024-13826/): Email Keep <= 1.1 - Email Deletion via CSRF (medium 5.4)
- [CVE-2024-13825](https://insights.sbomify.com/CVE-2024-13825/): Email Keep <= 1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13824](https://insights.sbomify.com/CVE-2024-13824/): CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-13823](https://insights.sbomify.com/CVE-2024-13823/): 360 Product Rotation <= 1.5.8 - Reflected XSS (medium 6.1)
- [CVE-2024-13822](https://insights.sbomify.com/CVE-2024-13822/): Total Contest Lite <= 2.8.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13821](https://insights.sbomify.com/CVE-2024-13821/): WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation (medium 5.3)
- [CVE-2024-13820](https://insights.sbomify.com/CVE-2024-13820/): Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash (medium 5.3)
- [CVE-2024-1382](https://insights.sbomify.com/CVE-2024-1382/): Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-13818](https://insights.sbomify.com/CVE-2024-13818/): Information disclosure in Pie Register – User Registration, Profiles & Content Restriction (medium 5.3)
- [CVE-2024-13816](https://insights.sbomify.com/CVE-2024-13816/): Missing authorization in Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit (medium 5.4)
- [CVE-2024-13815](https://insights.sbomify.com/CVE-2024-13815/): Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-13814](https://insights.sbomify.com/CVE-2024-13814/): Global Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (medium 5.4)
- [CVE-2024-13813](https://insights.sbomify.com/CVE-2024-13813/): Misconfiguration in Secure Access Client (high 7.1)
- [CVE-2024-13812](https://insights.sbomify.com/CVE-2024-13812/): Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-13811](https://insights.sbomify.com/CVE-2024-13811/): Missing authorization in Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme (medium 4.3)
- [CVE-2024-13810](https://insights.sbomify.com/CVE-2024-13810/): Missing authorization in Zass - WooCommerce Theme for Handmade Artists and Artisans (medium 4.3)
- [CVE-2024-1381](https://insights.sbomify.com/CVE-2024-1381/): Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure (medium 6.5)
- [CVE-2024-13809](https://insights.sbomify.com/CVE-2024-13809/): Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/472/