Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 475 of 521.
- CVE-2024-13611 Information disclosure in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages
- CVE-2024-13610 Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS
- CVE-2024-1361 Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder
- CVE-2024-13609 Information disclosure in 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone
- CVE-2024-13608 Track Logins <= 1.0 - Admin+ SQL Injection
- CVE-2024-13607 Missing authorization in JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-13606 Information disclosure in JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-13605 Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS
- CVE-2024-13604 Information disclosure in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
- CVE-2024-13603 Wise Forms <= 1.2.0 - Unauthenticated Stored XSS
- CVE-2024-13602 Poll Maker < 5.5.4 - Admin+ Stored XSS
- CVE-2024-13601 Missing authorization in Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
- CVE-2024-13600 Information disclosure in Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
- CVE-2024-1360 Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation
- CVE-2024-13599 Cross-site scripting in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- CVE-2024-13598 XSS in iKSORIS
- CVE-2024-13597 XSS in iKSORIS
- CVE-2024-13596 SQL injection in WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
- CVE-2024-13595 Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection
- CVE-2024-13594 Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection
- CVE-2024-13593 BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-13592 Path traversal in Team Builder For WPBakery Page Builder(Formerly Visual Composer)
- CVE-2024-13591 Cross-site scripting in Team Builder For WPBakery Page Builder(Formerly Visual Composer)
- CVE-2024-13590 Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1359 Command injection in Enterprise Server
- CVE-2024-13589 YouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13588 Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13587 Cross-site scripting in Zigaform – Price Calculator & Cost Estimation Form Builder Lite
- CVE-2024-13586 Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13585 Ajax Search Lite < 4.12.5 - Admin+ Stored XSS
- CVE-2024-13584 Cross-site scripting in Picture Gallery – Frontend Image Uploads, AJAX Photo List
- CVE-2024-13583 Simple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13582 Cross-site scripting in Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer)
- CVE-2024-13581 Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13580 XV Random Quotes <= 1.40 - Settings Reset via CSRF
- CVE-2024-1358 Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion
- CVE-2024-13579 WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13578 WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13577 CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13576 Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13575 Web Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13574 XV Random Quotes <= 1.40 - Reflected XSS
- CVE-2024-13573 Zigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13572 Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting
- CVE-2024-13571 Post Timeline < 2.3.10 - Reflected XSS
- CVE-2024-13570 Stray Random Quotes <= 1.9.9 - Reflected XSS
- CVE-2024-1357 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-13569 Front End Users <= 3.2.32 - Reflected XSS
- CVE-2024-13568 Information disclosure in Fluent Support – Helpdesk & Customer Support Ticket System
- CVE-2024-13567 Information disclosure in Awesome Support – WordPress HelpDesk & Support Plugin
- CVE-2024-13566 WP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- CVE-2024-13565 Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
- CVE-2024-13564 Cross-site scripting in Rife Extensions & Templates for Elementor
- CVE-2024-13563 Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode
- CVE-2024-13562 Information disclosure in Import WP – Export and Import CSV and XML files to WordPress
- CVE-2024-13561 Cross-site scripting in Target Video Easy Publish
- CVE-2024-13560 Subscriptions & Memberships for PayPal <= 1.1.6 - Cross-Site Request Forgery to Arbitrary Post Deletion
- CVE-2024-1356 Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-13559 TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13558 Missing authorization in NP Quote Request for WooCommerce
- CVE-2024-13557 Shortcodes by United Themes <= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13556 Deserialization in Affiliate Links – Link Cloaking and Management
- CVE-2024-13555 Cross-site request forgery in 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone
- CVE-2024-13554 Missing authorization in The Ultimate WordPress Toolkit – WP Extended
- CVE-2024-13553 SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation
- CVE-2024-13552 SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
- CVE-2024-13551 ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13550 ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read
- CVE-2024-1355 Command injection in Enterprise Server
- CVE-2024-13549 All Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13548 Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13547 aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13546 GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description'
- CVE-2024-13545 Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion
- CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload
- CVE-2024-13543 Zarinpal Paid Downloads <= 2.3 - Reflected XSS
- CVE-2024-13542 Cross-site scripting in WP Google Street View (with 360° virtual tour) & Google maps + Local SEO
- CVE-2024-13541 Missing authorization in aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory
- CVE-2024-13540 WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure
- CVE-2024-1354 Command injection in Enterprise Server
- CVE-2024-13539 AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure
- CVE-2024-13538 BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute
- CVE-2024-13537 C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure
- CVE-2024-13536 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure
- CVE-2024-13535 Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure
- CVE-2024-13534 Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection
- CVE-2024-13533 Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injection
- CVE-2024-13532 Small Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection
- CVE-2024-13531 ShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injection
- CVE-2024-13530 Missing authorization in Login Page Styler – Custom WordPress Login Page Customizer & Security
- CVE-2024-1353 PHPEMS index.api.php index deserialization
- CVE-2024-13529 SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download
- CVE-2024-13528 Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode
- CVE-2024-13527 Cross-site scripting in Philantro – Donations and Donor Management
- CVE-2024-13526 Missing authorization in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-13525 Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
- CVE-2024-13524 obsproject OBS Studio untrusted search path
- CVE-2024-13523 MemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13522 magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13521 MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting