Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 473 of 521.
- CVE-2024-13808 Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution
- CVE-2024-13807 Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files
- CVE-2024-13806 Authors List <= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13805 Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-13804 Auth bypass in HPE Insight Cluster Management Utility (CMU)
- CVE-2024-13803 Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- CVE-2024-13802 Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13801 Missing authorization in BWL Advanced FAQ Manager
- CVE-2024-13800 Missing authorization in ConvertPlus
- CVE-2024-1380 Missing authorization in Relevanssi Premium
- CVE-2024-13799 Cross-site scripting in File Sharing & Download Manager – User Private Files
- CVE-2024-13798 Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
- CVE-2024-13797 PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13796 Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure
- CVE-2024-13795 Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message
- CVE-2024-13794 Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure
- CVE-2024-13793 Code injection in Wolmart | Multi-Vendor Marketplace WooCommerce Theme
- CVE-2024-13792 WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids
- CVE-2024-13791 Path traversal in Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
- CVE-2024-13790 MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion
- CVE-2024-1379 Website Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13789 Ravpage <= 2.31 - PHP Object Injection
- CVE-2024-13787 VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2024-13786 Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
- CVE-2024-13785 Code injection in Contact Form, Survey, Quiz & Popup Form Builder – ARForms
- CVE-2024-13784 Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
- CVE-2024-13783 FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php
- CVE-2024-13781 Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13780 Missing authorization in Hero Mega Menu - Responsive WordPress Menu Plugin
- CVE-2024-1378 Command injection in Enterprise Server
- CVE-2024-13779 Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting
- CVE-2024-13778 Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13777 ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
- CVE-2024-13776 Missing authorization in ZoomSounds - WordPress Wave Audio Player with Playlist
- CVE-2024-13775 Missing authorization in WooCommerce Support Ticket System
- CVE-2024-13774 Cross-site request forgery in Wishlist for WooCommerce: Multi Wishlists Per Customer
- CVE-2024-13773 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure
- CVE-2024-13772 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass
- CVE-2024-13771 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update
- CVE-2024-13770 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection
- CVE-2024-1377 Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget
- CVE-2024-13769 Missing authorization in Puzzles | WP Magazine / Review with Store WordPress Theme + RTL
- CVE-2024-13768 Cross-site request forgery in CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts
- CVE-2024-13767 Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2024-1376 Event post <= 5.9.4 - Missing Authorization
- CVE-2024-13759 Local Privilege Escalation in Avira Prime 1.1.96.2 on Windows 10 x64
- CVE-2024-13758 CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery
- CVE-2024-13757 Cross-site scripting in Master Slider – Responsive Touch Slider
- CVE-2024-13753 Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover
- CVE-2024-13752 WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
- CVE-2024-13751 3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-13750 Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-1375 Event post <= 5.9.10 - Cross-Site Request Forgery
- CVE-2024-13749 StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-13748 Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter
- CVE-2024-13747 WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
- CVE-2024-13746 Missing authorization in Booking Calendar and Notification
- CVE-2024-13744 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload
- CVE-2024-13743 Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13742 iControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection
- CVE-2024-13741 Server-side request forgery in ProfileGrid – User Profiles, Groups and Communities
- CVE-2024-13740 Missing authorization in ProfileGrid – User Profiles, Groups and Communities
- CVE-2024-1374 Command injection in Enterprise Server
- CVE-2024-13739 Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter
- CVE-2024-13738 Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13737 Missing authorization in Motors – Car Dealership & Classified Listings Plugin
- CVE-2024-13736 Pure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter
- CVE-2024-13735 HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name
- CVE-2024-13734 Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget
- CVE-2024-13733 SKT Blocks – Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13732 Cross-site scripting in Responsive Blocks – Page Builder for Blocks & Patterns
- CVE-2024-13731 Cross-site scripting in Alert Box Block – Display Custom Alerts and Messages
- CVE-2024-13730 Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS
- CVE-2024-13729 Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS
- CVE-2024-13728 Accept Donations with PayPal & Stripe <= 1.4.4 - Reflected Cross-Site Scripting
- CVE-2024-13727 MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS
- CVE-2024-13726 Themes Coder <= 1.3.4 - Unauthenticated SQLi
- CVE-2024-13725 Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion
- CVE-2024-13724 Missing authorization in Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
- CVE-2024-13723 Checkmk NagVis Remote Code Execution
- CVE-2024-13722 Checkmk NagVis Reflected Cross-site Scripting
- CVE-2024-13721 Plethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor
- CVE-2024-13720 WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2024-1372 Command injection in Enterprise Server
- CVE-2024-13719 PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
- CVE-2024-13718 Cross-site request forgery in Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later
- CVE-2024-13717 Missing authorization in Contact Form and Calls To Action by vcita
- CVE-2024-13716 Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- CVE-2024-13715 zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing
- CVE-2024-13714 All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13713 WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13712 Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection
- CVE-2024-13711 Pollin <= 1.01.1 - Reflected Cross-Site Scripting
- CVE-2024-13710 Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings Update
- CVE-2024-1371 LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- CVE-2024-13709 Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset
- CVE-2024-13708 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13707 WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion
- CVE-2024-13706 WP Image Uploader <= 1.0.1 - Reflected Cross-Site Scripting
- CVE-2024-13705 StageShow <= 9.8.6 - Reflected Cross-Site Scripting