# Vulnerabilities published in 2024


- [CVE-2024-13611](https://insights.sbomify.com/CVE-2024-13611/): Information disclosure in Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages (high 7.5)
- [CVE-2024-13610](https://insights.sbomify.com/CVE-2024-13610/): Simple Social Media Share Buttons < 6.0.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1361](https://insights.sbomify.com/CVE-2024-1361/): Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builder (medium 4.3)
- [CVE-2024-13609](https://insights.sbomify.com/CVE-2024-13609/): Information disclosure in 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone (medium 5.9)
- [CVE-2024-13608](https://insights.sbomify.com/CVE-2024-13608/): Track Logins <= 1.0 - Admin+ SQL Injection (medium 4.7)
- [CVE-2024-13607](https://insights.sbomify.com/CVE-2024-13607/): Missing authorization in JS Help Desk – AI-Powered Support & Ticketing System (medium 4.3)
- [CVE-2024-13606](https://insights.sbomify.com/CVE-2024-13606/): Information disclosure in JS Help Desk – AI-Powered Support & Ticketing System (high 7.5)
- [CVE-2024-13605](https://insights.sbomify.com/CVE-2024-13605/): Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13604](https://insights.sbomify.com/CVE-2024-13604/): Information disclosure in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin (high 7.5)
- [CVE-2024-13603](https://insights.sbomify.com/CVE-2024-13603/): Wise Forms <= 1.2.0 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-13602](https://insights.sbomify.com/CVE-2024-13602/): Poll Maker < 5.5.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13601](https://insights.sbomify.com/CVE-2024-13601/): Missing authorization in Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin (medium 4.3)
- [CVE-2024-13600](https://insights.sbomify.com/CVE-2024-13600/): Information disclosure in Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin (high 7.5)
- [CVE-2024-1360](https://insights.sbomify.com/CVE-2024-1360/): Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation (medium 4.3)
- [CVE-2024-13599](https://insights.sbomify.com/CVE-2024-13599/): Cross-site scripting in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 6.4)
- [CVE-2024-13598](https://insights.sbomify.com/CVE-2024-13598/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-13597](https://insights.sbomify.com/CVE-2024-13597/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-13596](https://insights.sbomify.com/CVE-2024-13596/): SQL injection in WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress (medium 6.5)
- [CVE-2024-13595](https://insights.sbomify.com/CVE-2024-13595/): Simple Signup Form <= 1.6.5 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-13594](https://insights.sbomify.com/CVE-2024-13594/): Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-13593](https://insights.sbomify.com/CVE-2024-13593/): BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion (high 7.5)
- [CVE-2024-13592](https://insights.sbomify.com/CVE-2024-13592/): Path traversal in Team Builder For WPBakery Page Builder(Formerly Visual Composer) (high 7.5)
- [CVE-2024-13591](https://insights.sbomify.com/CVE-2024-13591/): Cross-site scripting in Team Builder For WPBakery Page Builder(Formerly Visual Composer) (medium 6.4)
- [CVE-2024-13590](https://insights.sbomify.com/CVE-2024-13590/): Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1359](https://insights.sbomify.com/CVE-2024-1359/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13589](https://insights.sbomify.com/CVE-2024-13589/): YouTube Playlists with Schema <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13588](https://insights.sbomify.com/CVE-2024-13588/): Simplebooklet PDF Viewer and Embedder <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13587](https://insights.sbomify.com/CVE-2024-13587/): Cross-site scripting in Zigaform – Price Calculator & Cost Estimation Form Builder Lite (medium 6.4)
- [CVE-2024-13586](https://insights.sbomify.com/CVE-2024-13586/): Masy Gallery <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13585](https://insights.sbomify.com/CVE-2024-13585/): Ajax Search Lite < 4.12.5 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13584](https://insights.sbomify.com/CVE-2024-13584/): Cross-site scripting in Picture Gallery – Frontend Image Uploads, AJAX Photo List (medium 6.4)
- [CVE-2024-13583](https://insights.sbomify.com/CVE-2024-13583/): Simple Gallery with Filter <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13582](https://insights.sbomify.com/CVE-2024-13582/): Cross-site scripting in Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) (medium 6.4)
- [CVE-2024-13581](https://insights.sbomify.com/CVE-2024-13581/): Simple Charts <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13580](https://insights.sbomify.com/CVE-2024-13580/): XV Random Quotes <= 1.40 - Settings Reset via CSRF (medium 4.3)
- [CVE-2024-1358](https://insights.sbomify.com/CVE-2024-1358/): Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusion (high 8.8)
- [CVE-2024-13579](https://insights.sbomify.com/CVE-2024-13579/): WP-Asambleas <= 2.85.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13578](https://insights.sbomify.com/CVE-2024-13578/): WP-BibTeX <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13577](https://insights.sbomify.com/CVE-2024-13577/): CATS Job Listings <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13576](https://insights.sbomify.com/CVE-2024-13576/): Gumlet Video <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13575](https://insights.sbomify.com/CVE-2024-13575/): Web Stories Enhancer – Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13574](https://insights.sbomify.com/CVE-2024-13574/): XV Random Quotes <= 1.40 - Reflected XSS (high 7.1)
- [CVE-2024-13573](https://insights.sbomify.com/CVE-2024-13573/): Zigaform – Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13572](https://insights.sbomify.com/CVE-2024-13572/): Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting (medium 6.4)
- [CVE-2024-13571](https://insights.sbomify.com/CVE-2024-13571/): Post Timeline < 2.3.10 - Reflected XSS (high 7.1)
- [CVE-2024-13570](https://insights.sbomify.com/CVE-2024-13570/): Stray Random Quotes <= 1.9.9 - Reflected XSS (medium 6.1)
- [CVE-2024-1357](https://insights.sbomify.com/CVE-2024-1357/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-13569](https://insights.sbomify.com/CVE-2024-13569/): Front End Users <= 3.2.32 - Reflected XSS (high 7.1)
- [CVE-2024-13568](https://insights.sbomify.com/CVE-2024-13568/): Information disclosure in Fluent Support – Helpdesk & Customer Support Ticket System (high 7.5)
- [CVE-2024-13567](https://insights.sbomify.com/CVE-2024-13567/): Information disclosure in Awesome Support – WordPress HelpDesk & Support Plugin (high 7.5)
- [CVE-2024-13566](https://insights.sbomify.com/CVE-2024-13566/): WP DataTable <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-13565](https://insights.sbomify.com/CVE-2024-13565/): Simple Map No Api <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter (medium 6.4)
- [CVE-2024-13564](https://insights.sbomify.com/CVE-2024-13564/): Cross-site scripting in Rife Extensions & Templates for Elementor (medium 6.4)
- [CVE-2024-13563](https://insights.sbomify.com/CVE-2024-13563/): Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode (medium 6.4)
- [CVE-2024-13562](https://insights.sbomify.com/CVE-2024-13562/): Information disclosure in Import WP – Export and Import CSV and XML files to WordPress (high 7.5)
- [CVE-2024-13561](https://insights.sbomify.com/CVE-2024-13561/): Cross-site scripting in Target Video Easy Publish (medium 6.4)
- [CVE-2024-13560](https://insights.sbomify.com/CVE-2024-13560/): Subscriptions & Memberships for PayPal <= 1.1.6 - Cross-Site Request Forgery to Arbitrary Post Deletion (medium 4.3)
- [CVE-2024-1356](https://insights.sbomify.com/CVE-2024-1356/): Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (high 7.2)
- [CVE-2024-13559](https://insights.sbomify.com/CVE-2024-13559/): TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13558](https://insights.sbomify.com/CVE-2024-13558/): Missing authorization in NP Quote Request for WooCommerce (high 7.5)
- [CVE-2024-13557](https://insights.sbomify.com/CVE-2024-13557/): Shortcodes by United Themes <= 5.1.6 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-13556](https://insights.sbomify.com/CVE-2024-13556/): Deserialization in Affiliate Links – Link Cloaking and Management (high 8.1)
- [CVE-2024-13555](https://insights.sbomify.com/CVE-2024-13555/): Cross-site request forgery in 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone (medium 5.3)
- [CVE-2024-13554](https://insights.sbomify.com/CVE-2024-13554/): Missing authorization in The Ultimate WordPress Toolkit – WP Extended (medium 5.3)
- [CVE-2024-13553](https://insights.sbomify.com/CVE-2024-13553/): SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation (critical 9.8)
- [CVE-2024-13552](https://insights.sbomify.com/CVE-2024-13552/): SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2024-13551](https://insights.sbomify.com/CVE-2024-13551/): ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13550](https://insights.sbomify.com/CVE-2024-13550/): ABC Notation <= 6.1.3 - Authenticated (Contributor+) Arbitrary File Read (medium 6.5)
- [CVE-2024-1355](https://insights.sbomify.com/CVE-2024-1355/): Command injection in Enterprise Server (critical 9.1)
- [CVE-2024-13549](https://insights.sbomify.com/CVE-2024-13549/): All Bootstrap Blocks <= 1.3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13548](https://insights.sbomify.com/CVE-2024-13548/): Power Ups for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13547](https://insights.sbomify.com/CVE-2024-13547/): aThemes Addons for Elementor <= 1.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13546](https://insights.sbomify.com/CVE-2024-13546/): GenerateBlocks <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description' (medium 4.3)
- [CVE-2024-13545](https://insights.sbomify.com/CVE-2024-13545/): Bootstrap Ultimate <= 1.4.9 - Unauthenticated Limited Local File Inclusion (critical 9.8)
- [CVE-2024-13544](https://insights.sbomify.com/CVE-2024-13544/): Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload (medium 4.8)
- [CVE-2024-13543](https://insights.sbomify.com/CVE-2024-13543/): Zarinpal Paid Downloads <= 2.3 - Reflected XSS (medium 6.1)
- [CVE-2024-13542](https://insights.sbomify.com/CVE-2024-13542/): Cross-site scripting in WP Google Street View (with 360° virtual tour) & Google maps + Local SEO (medium 6.4)
- [CVE-2024-13541](https://insights.sbomify.com/CVE-2024-13541/): Missing authorization in aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory (medium 4.3)
- [CVE-2024-13540](https://insights.sbomify.com/CVE-2024-13540/): WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure (medium 5.3)
- [CVE-2024-1354](https://insights.sbomify.com/CVE-2024-1354/): Command injection in Enterprise Server (high 8.0)
- [CVE-2024-13539](https://insights.sbomify.com/CVE-2024-13539/): AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-13538](https://insights.sbomify.com/CVE-2024-13538/): BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute (medium 5.3)
- [CVE-2024-13537](https://insights.sbomify.com/CVE-2024-13537/): C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-13536](https://insights.sbomify.com/CVE-2024-13536/): 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-13535](https://insights.sbomify.com/CVE-2024-13535/): Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure (medium 5.3)
- [CVE-2024-13534](https://insights.sbomify.com/CVE-2024-13534/): Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13533](https://insights.sbomify.com/CVE-2024-13533/): Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13532](https://insights.sbomify.com/CVE-2024-13532/): Small Package Quotes – Purolator Edition <= 3.6.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13531](https://insights.sbomify.com/CVE-2024-13531/): ShipEngine Shipping Quotes <= 1.0.7 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13530](https://insights.sbomify.com/CVE-2024-13530/): Missing authorization in Login Page Styler – Custom WordPress Login Page Customizer & Security (medium 4.3)
- [CVE-2024-1353](https://insights.sbomify.com/CVE-2024-1353/): PHPEMS index.api.php index deserialization (medium 6.3)
- [CVE-2024-13529](https://insights.sbomify.com/CVE-2024-13529/): SocialV - Social Network and Community BuddyPress Theme <= 2.0.15 - Missing Authorization to Arbitrary File Download (medium 6.5)
- [CVE-2024-13528](https://insights.sbomify.com/CVE-2024-13528/): Customer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode (high 7.5)
- [CVE-2024-13527](https://insights.sbomify.com/CVE-2024-13527/): Cross-site scripting in Philantro – Donations and Donor Management (medium 6.4)
- [CVE-2024-13526](https://insights.sbomify.com/CVE-2024-13526/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 4.3)
- [CVE-2024-13525](https://insights.sbomify.com/CVE-2024-13525/): Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure (medium 6.5)
- [CVE-2024-13524](https://insights.sbomify.com/CVE-2024-13524/): obsproject OBS Studio untrusted search path (low 2.0)
- [CVE-2024-13523](https://insights.sbomify.com/CVE-2024-13523/): MemorialDay <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13522](https://insights.sbomify.com/CVE-2024-13522/): magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13521](https://insights.sbomify.com/CVE-2024-13521/): MailUp Auto Subscription <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/475/