Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 476 of 521.
- CVE-2024-13520 Missing authorization in Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)
- CVE-2024-1352 Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization
- CVE-2024-13519 Cross-site scripting in MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution
- CVE-2024-13518 Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing
- CVE-2024-13517 Cross-site scripting in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- CVE-2024-13516 Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting
- CVE-2024-13515 Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting
- CVE-2024-13514 Information disclosure in bSlider – Create Responsive Image, Post, Product, and Video Sliders
- CVE-2024-13513 Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
- CVE-2024-13512 Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13511 Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset
- CVE-2024-13510 ShopSite <= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-1351 MongoDB Server may allow successful untrusted connection
- CVE-2024-13509 WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13508 Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter
- CVE-2024-13507 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection
- CVE-2024-13506 Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- CVE-2024-13505 Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question
- CVE-2024-13504 Cross-site scripting in Shared Files – Frontend File Upload Form & Secure File Sharing
- CVE-2024-13503 Stack-Based Buffer Overflow in Newtec's update signaling causes RCE
- CVE-2024-13502 A command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces allows to exeucte arbitrary shell commands.
- CVE-2024-13501 WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13500 WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
- CVE-2024-1350 WordPress Honeypot for WP Comment plugin <= 2.2.3 - Arbitrary File Deletion vulnerability
- CVE-2024-13499 GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
- CVE-2024-13498 Information disclosure in NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2024-13497 Cross-site scripting in WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
- CVE-2024-13496 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
- CVE-2024-13495 GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
- CVE-2024-13494 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
- CVE-2024-13493 Sensly Online Presence <= 0.6 - Admin+ Stored XSS
- CVE-2024-13492 Guten Free Options <= 0.9.5 - Reflected XSS
- CVE-2024-13491 Small Package Quotes – For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injection
- CVE-2024-13490 LTL Freight Quotes – XPO Edition <= 4.3.7 - Unauthenticated SQL Injection
- CVE-2024-1349 EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13489 LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection
- CVE-2024-13488 LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection
- CVE-2024-13487 Code injection in CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x
- CVE-2024-13486 Icegram Engage < 3.1.32 - Admin+ Stored XSS
- CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection
- CVE-2024-13484 Openshift-gitops-operator-container: namespace isolation break
- CVE-2024-13483 LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection
- CVE-2024-13482 Icegram Engage < 3.1.32 - Admin+ Stored XSS
- CVE-2024-13481 LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection
- CVE-2024-13480 LTL Freight Quotes – For Customers of FedEx Freight <= 3.4.1 - Unauthenticated SQL Injection
- CVE-2024-1348 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-13479 LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection
- CVE-2024-13478 LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection
- CVE-2024-13477 LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection
- CVE-2024-13476 LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection
- CVE-2024-13475 Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection
- CVE-2024-13474 LTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection
- CVE-2024-13473 LTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection
- CVE-2024-13472 Code injection in Product Table and List Builder for WooCommerce Lite
- CVE-2024-13471 Path traversal in DesignThemes Core Features
- CVE-2024-13470 Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You
- CVE-2024-1347 Authentication Bypass by Spoofing in GitLab
- CVE-2024-13469 Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13468 Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- CVE-2024-13467 WP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scripting
- CVE-2024-13466 Automatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13465 aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13464 Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13463 SeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13462 WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13461 Cross-site scripting in Autoship Cloud for WooCommerce Subscription Products
- CVE-2024-13460 WE – Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1346 Weak MySQL database root password in LaborOfficeFree
- CVE-2024-13459 FuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13458 Cross-site scripting in WordPress SEO Friendly Accordion FAQ with AI assisted content generation
- CVE-2024-13457 Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure
- CVE-2024-13456 Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13455 igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13454 Weak cryptography in Easy-RSA
- CVE-2024-13453 Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13452 Cross-site request forgery in Contact Form by Supsystic
- CVE-2024-13451 Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
- CVE-2024-13450 Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery
- CVE-2024-1345 Weak MySQL database root password in LaborOfficeFree
- CVE-2024-13449 Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
- CVE-2024-13448 ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
- CVE-2024-13447 WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
- CVE-2024-13446 Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
- CVE-2024-13445 Cross-site scripting in Elementor Website Builder – more than just a page builder
- CVE-2024-13444 wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13443 Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13442 Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
- CVE-2024-13441 Bilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13440 Super Store Finder <= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting
- CVE-2024-1344 Encrypted database credentials in LaborOfficeFree
- CVE-2024-13439 Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- CVE-2024-13438 SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache
- CVE-2024-13437 Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update
- CVE-2024-13436 Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13435 Ebook Downloader <= 1.0 - Unauthenticated SQL Injection
- CVE-2024-13434 WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting
- CVE-2024-13433 Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13432 Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13431 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting
- CVE-2024-13430 Information disclosure in Page Builder: Pagelayer – Drag and Drop website builder