Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 477 of 521.
- CVE-2024-1343 Weak permission vulnerability in LaborOfficeFree
- CVE-2024-13429 WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion
- CVE-2024-13428 WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion
- CVE-2024-13427 Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder
- CVE-2024-13426 WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting
- CVE-2024-13425 WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
- CVE-2024-13424 Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update
- CVE-2024-13423 Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation
- CVE-2024-13422 SEO Blogger to WordPress Migration using 301 Redirection <= 0.4.8 - Reflected Cross-Site Scripting
- CVE-2024-13421 Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator
- CVE-2024-13420 Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates
- CVE-2024-13419 Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-13418 Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13417 Denial of service in 2N OS
- CVE-2024-13416 Information disclosure in 2N OS
- CVE-2024-13415 Missing authorization in Food Menu – Restaurant Menu & Online Ordering for WooCommerce
- CVE-2024-13413 ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter
- CVE-2024-13412 CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler
- CVE-2024-13411 Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function
- CVE-2024-13410 CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
- CVE-2024-1341 Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13409 Path traversal in Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
- CVE-2024-13408 Path traversal in Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
- CVE-2024-13407 Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-13406 XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting
- CVE-2024-13405 Apptivo Business Site CRM <= 5.3 - Cross-Site Request Forgery to IP Address Block
- CVE-2024-13404 Link Library <= 7.7.2 - Reflected Cross-Site Scripting
- CVE-2024-13403 WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter
- CVE-2024-13402 BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title'
- CVE-2024-13401 Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13400 Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1340 Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
- CVE-2024-13399 Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13398 Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13397 WPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13396 Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13395 Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13394 ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13393 Cross-site scripting in Video Share VOD – Turnkey Video Site Builder Script
- CVE-2024-13392 Cross-site scripting in Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings
- CVE-2024-13391 Cross-site scripting in MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
- CVE-2024-13390 ADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1339 ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize
- CVE-2024-13389 Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13388 TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13387 WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13386 quote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13385 JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13384 Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.24 - Admin+ Stored XSS
- CVE-2024-13383 HD Quiz < 2.0.0 - Editor+ Stored XSS
- CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS
- CVE-2024-13381 Calculated Fields Form < 5.2.62 - Admin+ Stored XSS
- CVE-2024-13380 Cross-site scripting in Alex Reservations: Smart Restaurant Booking
- CVE-2024-1338 ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll
- CVE-2024-13379 C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-13378 GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
- CVE-2024-13377 GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
- CVE-2024-13376 Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-13375 Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset
- CVE-2024-13374 Missing authorization in WP Table Manager
- CVE-2024-13373 Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update
- CVE-2024-13372 WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download
- CVE-2024-13371 WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending
- CVE-2024-13370 Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
- CVE-2024-1337 SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection
- CVE-2024-13369 Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter
- CVE-2024-13368 Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
- CVE-2024-13367 Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download
- CVE-2024-13366 Sandbox <= 0.4 - Reflected Cross-Site Scripting
- CVE-2024-13365 Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload
- CVE-2024-13364 Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset
- CVE-2024-13363 Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting
- CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
- CVE-2024-13361 Missing authorization in AI Puffer – Your AI engine for WordPress (formerly AI Power)
- CVE-2024-13360 AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2024-1336 ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOn
- CVE-2024-13359 Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload
- CVE-2024-13358 Missing authorization in BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
- CVE-2024-13357 Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS
- CVE-2024-13356 DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion
- CVE-2024-13355 File upload in Admin and Customer Messages After Order for WooCommerce: OrderConvo
- CVE-2024-13354 Cross-site scripting in Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates
- CVE-2024-13353 Path traversal in Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates
- CVE-2024-13352 Legull <= 1.2.2 - Reflected XSS
- CVE-2024-13351 Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13350 SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1335 ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimization
- CVE-2024-13349 Stockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13347 Essential WP Real Estate <= 1.1.3 - Reflected XSS
- CVE-2024-13346 Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13345 Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-13344 Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection
- CVE-2024-13343 WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
- CVE-2024-13342 Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload
- CVE-2024-13341 MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13340 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1334 ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization
- CVE-2024-13339 DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-13338 Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache
- CVE-2024-13337 Cross-site request forgery in Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer