# Vulnerabilities published in 2024


- [CVE-2024-13520](https://insights.sbomify.com/CVE-2024-13520/): Missing authorization in Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) (medium 5.3)
- [CVE-2024-1352](https://insights.sbomify.com/CVE-2024-1352/): Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization (medium 6.5)
- [CVE-2024-13519](https://insights.sbomify.com/CVE-2024-13519/): Cross-site scripting in MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution (medium 4.4)
- [CVE-2024-13518](https://insights.sbomify.com/CVE-2024-13518/): Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing (medium 4.3)
- [CVE-2024-13517](https://insights.sbomify.com/CVE-2024-13517/): Cross-site scripting in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (medium 4.4)
- [CVE-2024-13516](https://insights.sbomify.com/CVE-2024-13516/): Kubio AI Page Builder <= 2.3.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13515](https://insights.sbomify.com/CVE-2024-13515/): Image Source Control Lite – Show Image Credits and Captions <= 2.28.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13514](https://insights.sbomify.com/CVE-2024-13514/): Information disclosure in bSlider – Create Responsive Image, Post, Product, and Video Sliders (medium 4.3)
- [CVE-2024-13513](https://insights.sbomify.com/CVE-2024-13513/): Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation (critical 9.8)
- [CVE-2024-13512](https://insights.sbomify.com/CVE-2024-13512/): Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13511](https://insights.sbomify.com/CVE-2024-13511/): Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset (medium 4.3)
- [CVE-2024-13510](https://insights.sbomify.com/CVE-2024-13510/): ShopSite <= 1.5.10 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-1351](https://insights.sbomify.com/CVE-2024-1351/): MongoDB Server may allow successful untrusted connection (high 8.8)
- [CVE-2024-13509](https://insights.sbomify.com/CVE-2024-13509/): WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-13508](https://insights.sbomify.com/CVE-2024-13508/): Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter (medium 6.1)
- [CVE-2024-13507](https://insights.sbomify.com/CVE-2024-13507/): GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13506](https://insights.sbomify.com/CVE-2024-13506/): Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (medium 6.4)
- [CVE-2024-13505](https://insights.sbomify.com/CVE-2024-13505/): Survey Maker <= 5.1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Survey Question (medium 5.5)
- [CVE-2024-13504](https://insights.sbomify.com/CVE-2024-13504/): Cross-site scripting in Shared Files – Frontend File Upload Form & Secure File Sharing (high 7.2)
- [CVE-2024-13503](https://insights.sbomify.com/CVE-2024-13503/): Stack-Based Buffer Overflow in Newtec's update signaling causes RCE (critical 9.5)
- [CVE-2024-13502](https://insights.sbomify.com/CVE-2024-13502/): A command injection in the NTC2218, NTC2250, NTC2299 modems' web interfaces allows to exeucte arbitrary shell commands. (critical 9.3)
- [CVE-2024-13501](https://insights.sbomify.com/CVE-2024-13501/): WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13500](https://insights.sbomify.com/CVE-2024-13500/): WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter (medium 6.5)
- [CVE-2024-1350](https://insights.sbomify.com/CVE-2024-1350/): WordPress Honeypot for WP Comment plugin <= 2.2.3 - Arbitrary File Deletion vulnerability (medium 5.3)
- [CVE-2024-13499](https://insights.sbomify.com/CVE-2024-13499/): GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function (high 7.3)
- [CVE-2024-13498](https://insights.sbomify.com/CVE-2024-13498/): Information disclosure in NEX-Forms – Ultimate Forms Plugin for WordPress (medium 5.3)
- [CVE-2024-13497](https://insights.sbomify.com/CVE-2024-13497/): Cross-site scripting in WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto (high 7.2)
- [CVE-2024-13496](https://insights.sbomify.com/CVE-2024-13496/): GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter (high 7.5)
- [CVE-2024-13495](https://insights.sbomify.com/CVE-2024-13495/): GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function (high 7.3)
- [CVE-2024-13494](https://insights.sbomify.com/CVE-2024-13494/): WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details (medium 4.3)
- [CVE-2024-13493](https://insights.sbomify.com/CVE-2024-13493/): Sensly Online Presence <= 0.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13492](https://insights.sbomify.com/CVE-2024-13492/): Guten Free Options <= 0.9.5 - Reflected XSS (medium 6.1)
- [CVE-2024-13491](https://insights.sbomify.com/CVE-2024-13491/): Small Package Quotes – For Customers of FedEx <= 4.3.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13490](https://insights.sbomify.com/CVE-2024-13490/): LTL Freight Quotes – XPO Edition <= 4.3.7 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-1349](https://insights.sbomify.com/CVE-2024-1349/): EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13489](https://insights.sbomify.com/CVE-2024-13489/): LTL Freight Quotes – Old Dominion Edition <= 4.2.10 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13488](https://insights.sbomify.com/CVE-2024-13488/): LTL Freight Quotes – Estes Edition <= 3.3.7 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13487](https://insights.sbomify.com/CVE-2024-13487/): Code injection in CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x (high 7.3)
- [CVE-2024-13486](https://insights.sbomify.com/CVE-2024-13486/): Icegram Engage < 3.1.32 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13485](https://insights.sbomify.com/CVE-2024-13485/): LTL Freight Quotes – ABF Freight Edition <= 3.3.7 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13484](https://insights.sbomify.com/CVE-2024-13484/): Openshift-gitops-operator-container: namespace isolation break (high 8.2)
- [CVE-2024-13483](https://insights.sbomify.com/CVE-2024-13483/): LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13482](https://insights.sbomify.com/CVE-2024-13482/): Icegram Engage < 3.1.32 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13481](https://insights.sbomify.com/CVE-2024-13481/): LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13480](https://insights.sbomify.com/CVE-2024-13480/): LTL Freight Quotes – For Customers of FedEx Freight <= 3.4.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-1348](https://insights.sbomify.com/CVE-2024-1348/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-13479](https://insights.sbomify.com/CVE-2024-13479/): LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13478](https://insights.sbomify.com/CVE-2024-13478/): LTL Freight Quotes – TForce Edition <= 3.6.4 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13477](https://insights.sbomify.com/CVE-2024-13477/): LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13476](https://insights.sbomify.com/CVE-2024-13476/): LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13475](https://insights.sbomify.com/CVE-2024-13475/): Small Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13474](https://insights.sbomify.com/CVE-2024-13474/): LTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13473](https://insights.sbomify.com/CVE-2024-13473/): LTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13472](https://insights.sbomify.com/CVE-2024-13472/): Code injection in Product Table and List Builder for WooCommerce Lite (high 7.3)
- [CVE-2024-13471](https://insights.sbomify.com/CVE-2024-13471/): Path traversal in DesignThemes Core Features (high 7.5)
- [CVE-2024-13470](https://insights.sbomify.com/CVE-2024-13470/): Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You (medium 6.4)
- [CVE-2024-1347](https://insights.sbomify.com/CVE-2024-1347/): Authentication Bypass by Spoofing in GitLab (medium 4.3)
- [CVE-2024-13469](https://insights.sbomify.com/CVE-2024-13469/): Pricing Table by PickPlugins <= 1.12.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13468](https://insights.sbomify.com/CVE-2024-13468/): Trash Duplicate and 301 Redirect <= 1.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (high 7.5)
- [CVE-2024-13467](https://insights.sbomify.com/CVE-2024-13467/): WP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13466](https://insights.sbomify.com/CVE-2024-13466/): Automatically Hierarchic Categories in Menu <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13465](https://insights.sbomify.com/CVE-2024-13465/): aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13464](https://insights.sbomify.com/CVE-2024-13464/): Library Bookshelves <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13463](https://insights.sbomify.com/CVE-2024-13463/): SeatReg <= 1.56.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13462](https://insights.sbomify.com/CVE-2024-13462/): WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13461](https://insights.sbomify.com/CVE-2024-13461/): Cross-site scripting in Autoship Cloud for WooCommerce Subscription Products (medium 6.4)
- [CVE-2024-13460](https://insights.sbomify.com/CVE-2024-13460/): WE – Testimonial Slider <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1346](https://insights.sbomify.com/CVE-2024-1346/): Weak MySQL database root password in LaborOfficeFree (medium 6.8)
- [CVE-2024-13459](https://insights.sbomify.com/CVE-2024-13459/): FuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13458](https://insights.sbomify.com/CVE-2024-13458/): Cross-site scripting in WordPress SEO Friendly Accordion FAQ with AI assisted content generation (medium 6.4)
- [CVE-2024-13457](https://insights.sbomify.com/CVE-2024-13457/): Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-13456](https://insights.sbomify.com/CVE-2024-13456/): Easy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13455](https://insights.sbomify.com/CVE-2024-13455/): igumbi Online Booking <= 1.40 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13454](https://insights.sbomify.com/CVE-2024-13454/): Weak cryptography in Easy-RSA (medium 5.3)
- [CVE-2024-13453](https://insights.sbomify.com/CVE-2024-13453/): Contact Form & SMTP Plugin for WordPress by PirateForms <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-13452](https://insights.sbomify.com/CVE-2024-13452/): Cross-site request forgery in Contact Form by Supsystic (medium 6.1)
- [CVE-2024-13451](https://insights.sbomify.com/CVE-2024-13451/): Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-13450](https://insights.sbomify.com/CVE-2024-13450/): Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery (low 3.8)
- [CVE-2024-1345](https://insights.sbomify.com/CVE-2024-1345/): Weak MySQL database root password in LaborOfficeFree (medium 6.8)
- [CVE-2024-13449](https://insights.sbomify.com/CVE-2024-13449/): Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (medium 4.3)
- [CVE-2024-13448](https://insights.sbomify.com/CVE-2024-13448/): ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data (critical 9.8)
- [CVE-2024-13447](https://insights.sbomify.com/CVE-2024-13447/): WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (medium 4.3)
- [CVE-2024-13446](https://insights.sbomify.com/CVE-2024-13446/): Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover (critical 9.8)
- [CVE-2024-13445](https://insights.sbomify.com/CVE-2024-13445/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 6.4)
- [CVE-2024-13444](https://insights.sbomify.com/CVE-2024-13444/): wp-greet <= 6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13443](https://insights.sbomify.com/CVE-2024-13443/): Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13442](https://insights.sbomify.com/CVE-2024-13442/): Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover (critical 9.8)
- [CVE-2024-13441](https://insights.sbomify.com/CVE-2024-13441/): Bilingual Linker <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13440](https://insights.sbomify.com/CVE-2024-13440/): Super Store Finder <= 7.0 - Unauthenticated SQL Injection to Stored Cross-Site Scripting (high 8.2)
- [CVE-2024-1344](https://insights.sbomify.com/CVE-2024-1344/): Encrypted database credentials in LaborOfficeFree (medium 6.8)
- [CVE-2024-13439](https://insights.sbomify.com/CVE-2024-13439/): Team – Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.3)
- [CVE-2024-13438](https://insights.sbomify.com/CVE-2024-13438/): SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache (medium 4.3)
- [CVE-2024-13437](https://insights.sbomify.com/CVE-2024-13437/): Book a Room <= 2.9 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2024-13436](https://insights.sbomify.com/CVE-2024-13436/): Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13435](https://insights.sbomify.com/CVE-2024-13435/): Ebook Downloader <= 1.0 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13434](https://insights.sbomify.com/CVE-2024-13434/): WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13433](https://insights.sbomify.com/CVE-2024-13433/): Utilities for MTG <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13432](https://insights.sbomify.com/CVE-2024-13432/): Webcamconsult <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13431](https://insights.sbomify.com/CVE-2024-13431/): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13430](https://insights.sbomify.com/CVE-2024-13430/): Information disclosure in Page Builder: Pagelayer – Drag and Drop website builder (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/476/