# Vulnerabilities published in 2024


- [CVE-2024-13704](https://insights.sbomify.com/CVE-2024-13704/): Super Testimonials <= 4.0.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-13703](https://insights.sbomify.com/CVE-2024-13703/): CRM and Lead Management by vcita <= 2.7.5 - Missing Authorization to Authenticated (Susbcriber+) Widget Toggle (medium 4.3)
- [CVE-2024-13702](https://insights.sbomify.com/CVE-2024-13702/): CRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13701](https://insights.sbomify.com/CVE-2024-13701/): Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13700](https://insights.sbomify.com/CVE-2024-13700/): Embed Swagger UI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1370](https://insights.sbomify.com/CVE-2024-1370/): Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-13699](https://insights.sbomify.com/CVE-2024-13699/): Qi Addons For Elementor <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13698](https://insights.sbomify.com/CVE-2024-13698/): Missing authorization in Jobify - Job Board WordPress Theme (medium 6.5)
- [CVE-2024-13697](https://insights.sbomify.com/CVE-2024-13697/): Server-side request forgery in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages (medium 4.8)
- [CVE-2024-13696](https://insights.sbomify.com/CVE-2024-13696/): Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter (high 7.2)
- [CVE-2024-13695](https://insights.sbomify.com/CVE-2024-13695/): Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id (medium 6.4)
- [CVE-2024-13694](https://insights.sbomify.com/CVE-2024-13694/): WooCommerce Wishlist <= 1.8.7 - Unauthenticated Wishlist Disclosure via download_pdf_file Function (high 7.5)
- [CVE-2024-13693](https://insights.sbomify.com/CVE-2024-13693/): Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php (medium 5.3)
- [CVE-2024-13692](https://insights.sbomify.com/CVE-2024-13692/): Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference (medium 5.4)
- [CVE-2024-13691](https://insights.sbomify.com/CVE-2024-13691/): Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia (medium 6.5)
- [CVE-2024-13690](https://insights.sbomify.com/CVE-2024-13690/): WP Church Donation <= 1.7 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-1369](https://insights.sbomify.com/CVE-2024-1369/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13689](https://insights.sbomify.com/CVE-2024-13689/): Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias (medium 6.3)
- [CVE-2024-13688](https://insights.sbomify.com/CVE-2024-13688/): Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass (medium 5.3)
- [CVE-2024-13687](https://insights.sbomify.com/CVE-2024-13687/): Team Builder – Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.3)
- [CVE-2024-13686](https://insights.sbomify.com/CVE-2024-13686/): VW Storefront <= 0.9.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (medium 4.3)
- [CVE-2024-13685](https://insights.sbomify.com/CVE-2024-13685/): Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing (medium 5.3)
- [CVE-2024-13684](https://insights.sbomify.com/CVE-2024-13684/): Reset <= 1.6 - Cross-Site Request Forgery to Database Reset (high 8.1)
- [CVE-2024-13683](https://insights.sbomify.com/CVE-2024-13683/): Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update (medium 4.3)
- [CVE-2024-13682](https://insights.sbomify.com/CVE-2024-13682/): Cross-site request forgery in Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (medium 4.3)
- [CVE-2024-13681](https://insights.sbomify.com/CVE-2024-13681/): Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed (high 7.5)
- [CVE-2024-13680](https://insights.sbomify.com/CVE-2024-13680/): Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-1368](https://insights.sbomify.com/CVE-2024-1368/): Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication (medium 5.3)
- [CVE-2024-13679](https://insights.sbomify.com/CVE-2024-13679/): Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13678](https://insights.sbomify.com/CVE-2024-13678/): R3W Instafeed <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13677](https://insights.sbomify.com/CVE-2024-13677/): Missing authorization in GetBookingsWP – Appointments Booking Calendar Plugin For WordPress (high 8.8)
- [CVE-2024-13676](https://insights.sbomify.com/CVE-2024-13676/): Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-13675](https://insights.sbomify.com/CVE-2024-13675/): Cross-site scripting in SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) (medium 6.4)
- [CVE-2024-13674](https://insights.sbomify.com/CVE-2024-13674/): Cross-site scripting in Cosmic Blocks (40+) Content Editor Blocks Collection (medium 6.4)
- [CVE-2024-13673](https://insights.sbomify.com/CVE-2024-13673/): Big Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13672](https://insights.sbomify.com/CVE-2024-13672/): Cross-site scripting in Mini Course Generator | Embed mini-courses and interactive content (medium 6.4)
- [CVE-2024-13671](https://insights.sbomify.com/CVE-2024-13671/): Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read (high 7.5)
- [CVE-2024-13670](https://insights.sbomify.com/CVE-2024-13670/): Music Sheet Viewer <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1367](https://insights.sbomify.com/CVE-2024-1367/): Command Injection Vulnerability in Tenable Security Center (high 7.2)
- [CVE-2024-13669](https://insights.sbomify.com/CVE-2024-13669/): CalendApp <= 1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13668](https://insights.sbomify.com/CVE-2024-13668/): WordPress Activity O Meter <= 1 - Reflected XSS (high 7.1)
- [CVE-2024-13667](https://insights.sbomify.com/CVE-2024-13667/): Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description (medium 5.4)
- [CVE-2024-13666](https://insights.sbomify.com/CVE-2024-13666/): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing (medium 5.3)
- [CVE-2024-13665](https://insights.sbomify.com/CVE-2024-13665/): Admire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13664](https://insights.sbomify.com/CVE-2024-13664/): WP Post List Table <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13663](https://insights.sbomify.com/CVE-2024-13663/): Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13662](https://insights.sbomify.com/CVE-2024-13662/): eHive Objects Image Grid <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13661](https://insights.sbomify.com/CVE-2024-13661/): Table Editor <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13660](https://insights.sbomify.com/CVE-2024-13660/): Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1366](https://insights.sbomify.com/CVE-2024-1366/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-13659](https://insights.sbomify.com/CVE-2024-13659/): Listamester <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13658](https://insights.sbomify.com/CVE-2024-13658/): NGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13657](https://insights.sbomify.com/CVE-2024-13657/): Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13656](https://insights.sbomify.com/CVE-2024-13656/): Missing authorization in Click Mag - Viral WordPress News Magazine/Blog Theme (high 8.1)
- [CVE-2024-13655](https://insights.sbomify.com/CVE-2024-13655/): Missing authorization in Flex Mag - Responsive WordPress News Theme (high 8.1)
- [CVE-2024-13654](https://insights.sbomify.com/CVE-2024-13654/): Missing authorization in ZoxPress - The All-In-One WordPress News Theme (high 8.1)
- [CVE-2024-13653](https://insights.sbomify.com/CVE-2024-13653/): Missing authorization in ZoxPress - The All-In-One WordPress News Theme (high 8.8)
- [CVE-2024-13652](https://insights.sbomify.com/CVE-2024-13652/): ECPay Ecommerce for WooCommerce <= 1.1.2411060 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (medium 4.3)
- [CVE-2024-13651](https://insights.sbomify.com/CVE-2024-13651/): Missing authorization in RapidLoad AI – Optimize Web Vitals Automatically (medium 4.3)
- [CVE-2024-13650](https://insights.sbomify.com/CVE-2024-13650/): Piotnet Addons For Elementor <= 2.4.36 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1365](https://insights.sbomify.com/CVE-2024-1365/): YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13649](https://insights.sbomify.com/CVE-2024-13649/): 140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13648](https://insights.sbomify.com/CVE-2024-13648/): Maps for WP <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13647](https://insights.sbomify.com/CVE-2024-13647/): School Management System – SakolaWP <= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation (medium 4.3)
- [CVE-2024-13646](https://insights.sbomify.com/CVE-2024-13646/): Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update (high 8.1)
- [CVE-2024-13645](https://insights.sbomify.com/CVE-2024-13645/): TagDiv Composer <= 5.3 - Unauthenticated Arbitrary PHP Object Instantiation (critical 9.8)
- [CVE-2024-13644](https://insights.sbomify.com/CVE-2024-13644/): DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget (medium 6.4)
- [CVE-2024-13643](https://insights.sbomify.com/CVE-2024-13643/): Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification (high 8.8)
- [CVE-2024-13642](https://insights.sbomify.com/CVE-2024-13642/): Cross-site scripting in Stratum Widgets for Elementor (medium 6.4)
- [CVE-2024-13641](https://insights.sbomify.com/CVE-2024-13641/): Information disclosure in Return Refund and Exchange For WooCommerce (medium 5.9)
- [CVE-2024-13640](https://insights.sbomify.com/CVE-2024-13640/): Information disclosure in Print Invoice & Delivery Notes for WooCommerce (medium 5.9)
- [CVE-2024-1364](https://insights.sbomify.com/CVE-2024-1364/): Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13639](https://insights.sbomify.com/CVE-2024-13639/): Missing authorization in Read More & Accordion (medium 4.3)
- [CVE-2024-13638](https://insights.sbomify.com/CVE-2024-13638/): Information disclosure in Order Attachments for WooCommerce (medium 5.9)
- [CVE-2024-13637](https://insights.sbomify.com/CVE-2024-13637/): Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activation (medium 6.5)
- [CVE-2024-13635](https://insights.sbomify.com/CVE-2024-13635/): VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure (medium 4.3)
- [CVE-2024-13634](https://insights.sbomify.com/CVE-2024-13634/): Post Sync <= 1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13633](https://insights.sbomify.com/CVE-2024-13633/): Simple Catalogue <= 1.0.2 - Reflected XSS (high 7.1)
- [CVE-2024-13632](https://insights.sbomify.com/CVE-2024-13632/): WP Extra Fields <= 1.0.1 - Reflected XSS (high 7.1)
- [CVE-2024-13631](https://insights.sbomify.com/CVE-2024-13631/): OM Stripe <= 02.00.00 - Reflected XSS (high 7.1)
- [CVE-2024-13630](https://insights.sbomify.com/CVE-2024-13630/): News List <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-1363](https://insights.sbomify.com/CVE-2024-1363/): Cross-site scripting in Easy Accordion – Responsive Accordion FAQ Builder and Product FAQ (medium 6.4)
- [CVE-2024-13629](https://insights.sbomify.com/CVE-2024-13629/): Pushbiz <= 1.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13628](https://insights.sbomify.com/CVE-2024-13628/): WP Pricing Table <= 1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13627](https://insights.sbomify.com/CVE-2024-13627/): WP Touch Slider <= 2.2 - Reflected XSS (medium 4.7)
- [CVE-2024-13626](https://insights.sbomify.com/CVE-2024-13626/): VR Frases <= 3.0.1 - Reflected XSS (high 7.1)
- [CVE-2024-13625](https://insights.sbomify.com/CVE-2024-13625/): Tube Video Ads Lite <= 1.5.7 - Reflected XSS (high 7.1)
- [CVE-2024-13624](https://insights.sbomify.com/CVE-2024-13624/): WPMovieLibrary <= 2.1.4.8 - Reflected XSS (high 7.1)
- [CVE-2024-13623](https://insights.sbomify.com/CVE-2024-13623/): Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (medium 5.9)
- [CVE-2024-13622](https://insights.sbomify.com/CVE-2024-13622/): Information disclosure in File Uploads Addon for WooCommerce (high 7.5)
- [CVE-2024-13621](https://insights.sbomify.com/CVE-2024-13621/): The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1362](https://insights.sbomify.com/CVE-2024-1362/): Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refresh (medium 4.3)
- [CVE-2024-13619](https://insights.sbomify.com/CVE-2024-13619/): LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13618](https://insights.sbomify.com/CVE-2024-13618/): Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF (high 7.2)
- [CVE-2024-13617](https://insights.sbomify.com/CVE-2024-13617/): Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download (high 8.6)
- [CVE-2024-13616](https://insights.sbomify.com/CVE-2024-13616/): VikBooking < 1.7.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13615](https://insights.sbomify.com/CVE-2024-13615/): Social Media Plugin by Social Snap <= 1.3.6 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13614](https://insights.sbomify.com/CVE-2024-13614/): Integer overflow in Kaspersky Anti-Ransomware Tool (medium 5.3)
- [CVE-2024-13613](https://insights.sbomify.com/CVE-2024-13613/): Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory (high 7.5)
- [CVE-2024-13612](https://insights.sbomify.com/CVE-2024-13612/): Cross-site scripting in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/474/