Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 474 of 521.
- CVE-2024-13704 Super Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13703 CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle
- CVE-2024-13702 CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13701 Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13700 Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1370 Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-13699 Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13698 Missing authorization in Jobify - Job Board WordPress Theme
- CVE-2024-13697 Server-side request forgery in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages
- CVE-2024-13696 Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter
- CVE-2024-13695 Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id
- CVE-2024-13694 WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function
- CVE-2024-13693 Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php
- CVE-2024-13692 Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
- CVE-2024-13691 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia
- CVE-2024-13690 WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-1369 Command injection in Enterprise Server
- CVE-2024-13689 Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias
- CVE-2024-13688 Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass
- CVE-2024-13687 Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- CVE-2024-13686 VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
- CVE-2024-13685 Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing
- CVE-2024-13684 Reset <= 1.6 - Cross-Site Request Forgery to Database Reset
- CVE-2024-13683 Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update
- CVE-2024-13682 Cross-site request forgery in Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
- CVE-2024-13681 Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed
- CVE-2024-13680 Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection
- CVE-2024-1368 Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication
- CVE-2024-13679 Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13678 R3W Instafeed <= 1.0 - Reflected XSS
- CVE-2024-13677 Missing authorization in GetBookingsWP – Appointments Booking Calendar Plugin For WordPress
- CVE-2024-13676 Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injection
- CVE-2024-13675 Cross-site scripting in SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
- CVE-2024-13674 Cross-site scripting in Cosmic Blocks (40+) Content Editor Blocks Collection
- CVE-2024-13673 Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13672 Cross-site scripting in Mini Course Generator | Embed mini-courses and interactive content
- CVE-2024-13671 Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read
- CVE-2024-13670 Music Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1367 Command Injection Vulnerability in Tenable Security Center
- CVE-2024-13669 CalendApp <= 1.1 - Reflected XSS
- CVE-2024-13668 WordPress Activity O Meter <= 1 - Reflected XSS
- CVE-2024-13667 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description
- CVE-2024-13666 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing
- CVE-2024-13665 Admire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13664 WP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13663 Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13662 eHive Objects Image Grid <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13661 Table Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13660 Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1366 Cross-site scripting in Happy Addons for Elementor
- CVE-2024-13659 Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13658 NGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13657 Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13656 Missing authorization in Click Mag - Viral WordPress News Magazine/Blog Theme
- CVE-2024-13655 Missing authorization in Flex Mag - Responsive WordPress News Theme
- CVE-2024-13654 Missing authorization in ZoxPress - The All-In-One WordPress News Theme
- CVE-2024-13653 Missing authorization in ZoxPress - The All-In-One WordPress News Theme
- CVE-2024-13652 ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
- CVE-2024-13651 Missing authorization in RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2024-13650 Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1365 YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scripting
- CVE-2024-13649 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13648 Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13647 School Management System – SakolaWP <= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation
- CVE-2024-13646 Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update
- CVE-2024-13645 TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation
- CVE-2024-13644 DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget
- CVE-2024-13643 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification
- CVE-2024-13642 Cross-site scripting in Stratum Widgets for Elementor
- CVE-2024-13641 Information disclosure in Return Refund and Exchange For WooCommerce
- CVE-2024-13640 Information disclosure in Print Invoice & Delivery Notes for WooCommerce
- CVE-2024-1364 Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13639 Missing authorization in Read More & Accordion
- CVE-2024-13638 Information disclosure in Order Attachments for WooCommerce
- CVE-2024-13637 Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation
- CVE-2024-13635 VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-13634 Post Sync <= 1.1 - Reflected XSS
- CVE-2024-13633 Simple Catalogue <= 1.0.2 - Reflected XSS
- CVE-2024-13632 WP Extra Fields <= 1.0.1 - Reflected XSS
- CVE-2024-13631 OM Stripe <= 02.00.00 - Reflected XSS
- CVE-2024-13630 News List <= 1.0 - Reflected XSS
- CVE-2024-1363 Cross-site scripting in Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ
- CVE-2024-13629 Pushbiz <= 1.0 - Reflected XSS
- CVE-2024-13628 WP Pricing Table <= 1.1 - Reflected XSS
- CVE-2024-13627 WP Touch Slider <= 2.2 - Reflected XSS
- CVE-2024-13626 VR Frases <= 3.0.1 - Reflected XSS
- CVE-2024-13625 Tube Video Ads Lite <= 1.5.7 - Reflected XSS
- CVE-2024-13624 WPMovieLibrary <= 2.1.4.8 - Reflected XSS
- CVE-2024-13623 Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- CVE-2024-13622 Information disclosure in File Uploads Addon for WooCommerce
- CVE-2024-13621 The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS
- CVE-2024-1362 Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh
- CVE-2024-13619 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS
- CVE-2024-13618 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
- CVE-2024-13617 Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
- CVE-2024-13616 VikBooking < 1.7.2 - Admin+ Stored XSS
- CVE-2024-13615 Social Media Plugin by Social Snap <= 1.3.6 - Admin+ Stored XSS
- CVE-2024-13614 Integer overflow in Kaspersky Anti-Ransomware Tool
- CVE-2024-13613 Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
- CVE-2024-13612 Cross-site scripting in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages