# Vulnerabilities published in 2024


- [CVE-2024-13808](https://insights.sbomify.com/CVE-2024-13808/): Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution (high 8.8)
- [CVE-2024-13807](https://insights.sbomify.com/CVE-2024-13807/): Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files (high 7.5)
- [CVE-2024-13806](https://insights.sbomify.com/CVE-2024-13806/): Authors List <= 2.0.6 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-13805](https://insights.sbomify.com/CVE-2024-13805/): Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-13804](https://insights.sbomify.com/CVE-2024-13804/): Auth bypass in HPE Insight Cluster Management Utility (CMU) (critical 9.8)
- [CVE-2024-13803](https://insights.sbomify.com/CVE-2024-13803/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2024-13802](https://insights.sbomify.com/CVE-2024-13802/): Bandsintown Events <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13801](https://insights.sbomify.com/CVE-2024-13801/): Missing authorization in BWL Advanced FAQ Manager (high 8.1)
- [CVE-2024-13800](https://insights.sbomify.com/CVE-2024-13800/): Missing authorization in ConvertPlus (high 8.1)
- [CVE-2024-1380](https://insights.sbomify.com/CVE-2024-1380/): Missing authorization in Relevanssi Premium (medium 5.3)
- [CVE-2024-13799](https://insights.sbomify.com/CVE-2024-13799/): Cross-site scripting in File Sharing & Download Manager – User Private Files (medium 6.4)
- [CVE-2024-13798](https://insights.sbomify.com/CVE-2024-13798/): Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation (medium 5.3)
- [CVE-2024-13797](https://insights.sbomify.com/CVE-2024-13797/): PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-13796](https://insights.sbomify.com/CVE-2024-13796/): Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure (medium 5.3)
- [CVE-2024-13795](https://insights.sbomify.com/CVE-2024-13795/): Ecwid by Lightspeed Ecommerce Shopping Cart <= 6.12.27 - Cross-Site Request Forgery to Send Deactivation Message (medium 4.3)
- [CVE-2024-13794](https://insights.sbomify.com/CVE-2024-13794/): Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure (medium 5.3)
- [CVE-2024-13793](https://insights.sbomify.com/CVE-2024-13793/): Code injection in Wolmart | Multi-Vendor Marketplace WooCommerce Theme (high 7.3)
- [CVE-2024-13792](https://insights.sbomify.com/CVE-2024-13792/): WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids (high 7.3)
- [CVE-2024-13791](https://insights.sbomify.com/CVE-2024-13791/): Path traversal in Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist (medium 4.9)
- [CVE-2024-13790](https://insights.sbomify.com/CVE-2024-13790/): MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion (critical 9.8)
- [CVE-2024-1379](https://insights.sbomify.com/CVE-2024-1379/): Website Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13789](https://insights.sbomify.com/CVE-2024-13789/): Ravpage <= 2.31 - PHP Object Injection (critical 9.8)
- [CVE-2024-13787](https://insights.sbomify.com/CVE-2024-13787/): VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection (critical 9.8)
- [CVE-2024-13786](https://insights.sbomify.com/CVE-2024-13786/): Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection (critical 9.8)
- [CVE-2024-13785](https://insights.sbomify.com/CVE-2024-13785/): Code injection in Contact Form, Survey, Quiz & Popup Form Builder – ARForms (medium 5.6)
- [CVE-2024-13784](https://insights.sbomify.com/CVE-2024-13784/): Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-13783](https://insights.sbomify.com/CVE-2024-13783/): FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php (medium 4.3)
- [CVE-2024-13781](https://insights.sbomify.com/CVE-2024-13781/): Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13780](https://insights.sbomify.com/CVE-2024-13780/): Missing authorization in Hero Mega Menu - Responsive WordPress Menu Plugin (medium 6.5)
- [CVE-2024-1378](https://insights.sbomify.com/CVE-2024-1378/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13779](https://insights.sbomify.com/CVE-2024-13779/): Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13778](https://insights.sbomify.com/CVE-2024-13778/): Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13777](https://insights.sbomify.com/CVE-2024-13777/): ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2024-13776](https://insights.sbomify.com/CVE-2024-13776/): Missing authorization in ZoomSounds - WordPress Wave Audio Player with Playlist (high 8.1)
- [CVE-2024-13775](https://insights.sbomify.com/CVE-2024-13775/): Missing authorization in WooCommerce Support Ticket System (medium 5.4)
- [CVE-2024-13774](https://insights.sbomify.com/CVE-2024-13774/): Cross-site request forgery in Wishlist for WooCommerce: Multi Wishlists Per Customer (medium 6.1)
- [CVE-2024-13773](https://insights.sbomify.com/CVE-2024-13773/): Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure (high 7.3)
- [CVE-2024-13772](https://insights.sbomify.com/CVE-2024-13772/): Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass (medium 5.6)
- [CVE-2024-13771](https://insights.sbomify.com/CVE-2024-13771/): Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update (critical 9.8)
- [CVE-2024-13770](https://insights.sbomify.com/CVE-2024-13770/): Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2024-1377](https://insights.sbomify.com/CVE-2024-1377/): Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget (medium 6.4)
- [CVE-2024-13769](https://insights.sbomify.com/CVE-2024-13769/): Missing authorization in Puzzles | WP Magazine / Review with Store WordPress Theme + RTL (medium 6.4)
- [CVE-2024-13768](https://insights.sbomify.com/CVE-2024-13768/): Cross-site request forgery in CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts (medium 4.3)
- [CVE-2024-13767](https://insights.sbomify.com/CVE-2024-13767/): Live2DWebCanvas <= 1.9.11 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.1)
- [CVE-2024-1376](https://insights.sbomify.com/CVE-2024-1376/): Event post <= 5.9.4 - Missing Authorization (medium 4.3)
- [CVE-2024-13759](https://insights.sbomify.com/CVE-2024-13759/): Local Privilege Escalation in Avira Prime 1.1.96.2 on Windows 10 x64 (high 7.8)
- [CVE-2024-13758](https://insights.sbomify.com/CVE-2024-13758/): CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery (medium 6.5)
- [CVE-2024-13757](https://insights.sbomify.com/CVE-2024-13757/): Cross-site scripting in Master Slider – Responsive Touch Slider (medium 6.4)
- [CVE-2024-13753](https://insights.sbomify.com/CVE-2024-13753/): Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover (high 8.1)
- [CVE-2024-13752](https://insights.sbomify.com/CVE-2024-13752/): WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (medium 6.5)
- [CVE-2024-13751](https://insights.sbomify.com/CVE-2024-13751/): 3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13750](https://insights.sbomify.com/CVE-2024-13750/): Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-1375](https://insights.sbomify.com/CVE-2024-1375/): Event post <= 5.9.10 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-13749](https://insights.sbomify.com/CVE-2024-13749/): StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13748](https://insights.sbomify.com/CVE-2024-13748/): Ultimate Classified Listings <= 1.4 Authenticated (Administrator+) Stored Cross-Site Scripting via Title Parameter (medium 4.4)
- [CVE-2024-13747](https://insights.sbomify.com/CVE-2024-13747/): WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection (medium 4.3)
- [CVE-2024-13746](https://insights.sbomify.com/CVE-2024-13746/): Missing authorization in Booking Calendar and Notification (medium 6.5)
- [CVE-2024-13744](https://insights.sbomify.com/CVE-2024-13744/): Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload (high 8.1)
- [CVE-2024-13743](https://insights.sbomify.com/CVE-2024-13743/): Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13742](https://insights.sbomify.com/CVE-2024-13742/): iControlWP – Multiple WordPress Site Manager <= 4.4.5 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-13741](https://insights.sbomify.com/CVE-2024-13741/): Server-side request forgery in ProfileGrid – User Profiles, Groups and Communities (medium 5.4)
- [CVE-2024-13740](https://insights.sbomify.com/CVE-2024-13740/): Missing authorization in ProfileGrid – User Profiles, Groups and Communities (medium 4.3)
- [CVE-2024-1374](https://insights.sbomify.com/CVE-2024-1374/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13739](https://insights.sbomify.com/CVE-2024-13739/): Newsletters <= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter (medium 6.1)
- [CVE-2024-13738](https://insights.sbomify.com/CVE-2024-13738/): Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-13737](https://insights.sbomify.com/CVE-2024-13737/): Missing authorization in Motors – Car Dealership & Classified Listings Plugin (medium 4.3)
- [CVE-2024-13736](https://insights.sbomify.com/CVE-2024-13736/): Pure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter (medium 6.1)
- [CVE-2024-13735](https://insights.sbomify.com/CVE-2024-13735/): HurryTimer <= 2.11.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name (medium 6.4)
- [CVE-2024-13734](https://insights.sbomify.com/CVE-2024-13734/): Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget (medium 6.4)
- [CVE-2024-13733](https://insights.sbomify.com/CVE-2024-13733/): SKT Blocks – Gutenberg based Page Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13732](https://insights.sbomify.com/CVE-2024-13732/): Cross-site scripting in Responsive Blocks – Page Builder for Blocks & Patterns (medium 6.4)
- [CVE-2024-13731](https://insights.sbomify.com/CVE-2024-13731/): Cross-site scripting in Alert Box Block – Display Custom Alerts and Messages (medium 6.4)
- [CVE-2024-13730](https://insights.sbomify.com/CVE-2024-13730/): Podlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13729](https://insights.sbomify.com/CVE-2024-13729/): Podlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13728](https://insights.sbomify.com/CVE-2024-13728/): Accept Donations with PayPal & Stripe <= 1.4.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13727](https://insights.sbomify.com/CVE-2024-13727/): MemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS (medium 6.1)
- [CVE-2024-13726](https://insights.sbomify.com/CVE-2024-13726/): Themes Coder <= 1.3.4 - Unauthenticated SQLi (high 8.6)
- [CVE-2024-13725](https://insights.sbomify.com/CVE-2024-13725/): Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion (critical 9.8)
- [CVE-2024-13724](https://insights.sbomify.com/CVE-2024-13724/): Missing authorization in Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (medium 4.3)
- [CVE-2024-13723](https://insights.sbomify.com/CVE-2024-13723/): Checkmk NagVis Remote Code Execution (high 7.2)
- [CVE-2024-13722](https://insights.sbomify.com/CVE-2024-13722/): Checkmk NagVis Reflected Cross-site Scripting (medium 5.4)
- [CVE-2024-13721](https://insights.sbomify.com/CVE-2024-13721/): Plethora Plugins Tabs + Accordions <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor (medium 6.4)
- [CVE-2024-13720](https://insights.sbomify.com/CVE-2024-13720/): WP Image Uploader <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion (high 8.8)
- [CVE-2024-1372](https://insights.sbomify.com/CVE-2024-1372/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13719](https://insights.sbomify.com/CVE-2024-13719/): PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure (medium 5.3)
- [CVE-2024-13718](https://insights.sbomify.com/CVE-2024-13718/): Cross-site request forgery in Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later (medium 4.3)
- [CVE-2024-13717](https://insights.sbomify.com/CVE-2024-13717/): Missing authorization in Contact Form and Calls To Action by vcita (medium 4.3)
- [CVE-2024-13716](https://insights.sbomify.com/CVE-2024-13716/): Forex Calculators <= 1.3.7 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.3)
- [CVE-2024-13715](https://insights.sbomify.com/CVE-2024-13715/): zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing (medium 4.3)
- [CVE-2024-13714](https://insights.sbomify.com/CVE-2024-13714/): All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-13713](https://insights.sbomify.com/CVE-2024-13713/): WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13712](https://insights.sbomify.com/CVE-2024-13712/): Pollin <= 1.01.1 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2024-13711](https://insights.sbomify.com/CVE-2024-13711/): Pollin <= 1.01.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13710](https://insights.sbomify.com/CVE-2024-13710/): Estatebud – Properties & Listings <= 5.5.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2024-1371](https://insights.sbomify.com/CVE-2024-1371/): LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (medium 6.5)
- [CVE-2024-13709](https://insights.sbomify.com/CVE-2024-13709/): Linear <= 2.8.1 - Cross-Site Request Forgery to Cache Reset (medium 4.3)
- [CVE-2024-13708](https://insights.sbomify.com/CVE-2024-13708/): Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-13707](https://insights.sbomify.com/CVE-2024-13707/): WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion (high 8.8)
- [CVE-2024-13706](https://insights.sbomify.com/CVE-2024-13706/): WP Image Uploader <= 1.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13705](https://insights.sbomify.com/CVE-2024-13705/): StageShow <= 9.8.6 - Reflected Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/473/