# Vulnerabilities published in 2024


- [CVE-2024-1343](https://insights.sbomify.com/CVE-2024-1343/): Weak permission vulnerability in LaborOfficeFree (medium 4.7)
- [CVE-2024-13429](https://insights.sbomify.com/CVE-2024-13429/): WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion (medium 4.3)
- [CVE-2024-13428](https://insights.sbomify.com/CVE-2024-13428/): WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion (medium 5.3)
- [CVE-2024-13427](https://insights.sbomify.com/CVE-2024-13427/): Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder (medium 6.4)
- [CVE-2024-13426](https://insights.sbomify.com/CVE-2024-13426/): WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-13425](https://insights.sbomify.com/CVE-2024-13425/): WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion (medium 4.3)
- [CVE-2024-13424](https://insights.sbomify.com/CVE-2024-13424/): Ni Sales Commission For WooCommerce <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update (medium 4.3)
- [CVE-2024-13423](https://insights.sbomify.com/CVE-2024-13423/): Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation (medium 5.3)
- [CVE-2024-13422](https://insights.sbomify.com/CVE-2024-13422/): SEO Blogger to WordPress Migration using 301 Redirection <= 0.4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13421](https://insights.sbomify.com/CVE-2024-13421/): Real Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator (critical 9.8)
- [CVE-2024-13420](https://insights.sbomify.com/CVE-2024-13420/): Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates (medium 4.3)
- [CVE-2024-13419](https://insights.sbomify.com/CVE-2024-13419/): Smart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13418](https://insights.sbomify.com/CVE-2024-13418/): Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-13417](https://insights.sbomify.com/CVE-2024-13417/): Denial of service in 2N OS (medium 4.6)
- [CVE-2024-13416](https://insights.sbomify.com/CVE-2024-13416/): Information disclosure in 2N OS (medium 4.3)
- [CVE-2024-13415](https://insights.sbomify.com/CVE-2024-13415/): Missing authorization in Food Menu – Restaurant Menu & Online Ordering for WooCommerce (medium 4.3)
- [CVE-2024-13413](https://insights.sbomify.com/CVE-2024-13413/): ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter (medium 6.1)
- [CVE-2024-13412](https://insights.sbomify.com/CVE-2024-13412/): CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler (high 7.5)
- [CVE-2024-13411](https://insights.sbomify.com/CVE-2024-13411/): Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function (medium 6.4)
- [CVE-2024-13410](https://insights.sbomify.com/CVE-2024-13410/): CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler (critical 9.8)
- [CVE-2024-1341](https://insights.sbomify.com/CVE-2024-1341/): Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 4.9)
- [CVE-2024-13409](https://insights.sbomify.com/CVE-2024-13409/): Path traversal in Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (high 7.5)
- [CVE-2024-13408](https://insights.sbomify.com/CVE-2024-13408/): Path traversal in Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget (high 7.5)
- [CVE-2024-13407](https://insights.sbomify.com/CVE-2024-13407/): Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-13406](https://insights.sbomify.com/CVE-2024-13406/): XML for Google Merchant Center <= 3.0.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13405](https://insights.sbomify.com/CVE-2024-13405/): Apptivo Business Site CRM <= 5.3 - Cross-Site Request Forgery to IP Address Block (medium 4.3)
- [CVE-2024-13404](https://insights.sbomify.com/CVE-2024-13404/): Link Library <= 7.7.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13403](https://insights.sbomify.com/CVE-2024-13403/): WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter (medium 6.4)
- [CVE-2024-13402](https://insights.sbomify.com/CVE-2024-13402/): BuddyBoss Platform <= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link_title' (medium 6.4)
- [CVE-2024-13401](https://insights.sbomify.com/CVE-2024-13401/): Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13400](https://insights.sbomify.com/CVE-2024-13400/): Kona Gallery Block <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1340](https://insights.sbomify.com/CVE-2024-1340/): Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization (medium 5.4)
- [CVE-2024-13399](https://insights.sbomify.com/CVE-2024-13399/): Gosign – Posts Slider Block <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13398](https://insights.sbomify.com/CVE-2024-13398/): Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13397](https://insights.sbomify.com/CVE-2024-13397/): WPRadio – WordPress Radio Streaming Plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13396](https://insights.sbomify.com/CVE-2024-13396/): Frictionless <= 0.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13395](https://insights.sbomify.com/CVE-2024-13395/): Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13394](https://insights.sbomify.com/CVE-2024-13394/): ViewMedica 9 <= 1.4.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13393](https://insights.sbomify.com/CVE-2024-13393/): Cross-site scripting in Video Share VOD – Turnkey Video Site Builder Script (medium 6.4)
- [CVE-2024-13392](https://insights.sbomify.com/CVE-2024-13392/): Cross-site scripting in Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings (medium 6.4)
- [CVE-2024-13391](https://insights.sbomify.com/CVE-2024-13391/): Cross-site scripting in MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet (medium 6.4)
- [CVE-2024-13390](https://insights.sbomify.com/CVE-2024-13390/): ADFO – Custom data in admin dashboard <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1339](https://insights.sbomify.com/CVE-2024-1339/): ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize (medium 4.3)
- [CVE-2024-13389](https://insights.sbomify.com/CVE-2024-13389/): Cliptakes <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13388](https://insights.sbomify.com/CVE-2024-13388/): TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13387](https://insights.sbomify.com/CVE-2024-13387/): WP Responsive Tabs <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13386](https://insights.sbomify.com/CVE-2024-13386/): quote-posttype-plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13385](https://insights.sbomify.com/CVE-2024-13385/): JSM Screenshot Machine Shortcode <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13384](https://insights.sbomify.com/CVE-2024-13384/): Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.24 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13383](https://insights.sbomify.com/CVE-2024-13383/): HD Quiz < 2.0.0 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-13382](https://insights.sbomify.com/CVE-2024-13382/): Calculated Fields Form < 5.2.64 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13381](https://insights.sbomify.com/CVE-2024-13381/): Calculated Fields Form < 5.2.62 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13380](https://insights.sbomify.com/CVE-2024-13380/): Cross-site scripting in Alex Reservations: Smart Restaurant Booking (medium 6.4)
- [CVE-2024-1338](https://insights.sbomify.com/CVE-2024-1338/): ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll (medium 4.3)
- [CVE-2024-13379](https://insights.sbomify.com/CVE-2024-13379/): C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-13378](https://insights.sbomify.com/CVE-2024-13378/): GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter (medium 5.4)
- [CVE-2024-13377](https://insights.sbomify.com/CVE-2024-13377/): GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter (high 7.2)
- [CVE-2024-13376](https://insights.sbomify.com/CVE-2024-13376/): Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-13375](https://insights.sbomify.com/CVE-2024-13375/): Adifier System <= 3.1.7 - Unauthenticated Arbitrary Password Reset (critical 9.8)
- [CVE-2024-13374](https://insights.sbomify.com/CVE-2024-13374/): Missing authorization in WP Table Manager (medium 4.3)
- [CVE-2024-13373](https://insights.sbomify.com/CVE-2024-13373/): Exertio Framework <= 1.3.1 - Unauthenticated Arbitrary User Password Update (high 8.1)
- [CVE-2024-13372](https://insights.sbomify.com/CVE-2024-13372/): WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download (medium 5.3)
- [CVE-2024-13371](https://insights.sbomify.com/CVE-2024-13371/): WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending (medium 5.3)
- [CVE-2024-13370](https://insights.sbomify.com/CVE-2024-13370/): Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 6.5)
- [CVE-2024-1337](https://insights.sbomify.com/CVE-2024-1337/): SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection (medium 4.3)
- [CVE-2024-13369](https://insights.sbomify.com/CVE-2024-13369/): Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter (medium 6.5)
- [CVE-2024-13368](https://insights.sbomify.com/CVE-2024-13368/): Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 4.3)
- [CVE-2024-13367](https://insights.sbomify.com/CVE-2024-13367/): Sandbox <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download (medium 6.5)
- [CVE-2024-13366](https://insights.sbomify.com/CVE-2024-13366/): Sandbox <= 0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13365](https://insights.sbomify.com/CVE-2024-13365/): Security & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-13364](https://insights.sbomify.com/CVE-2024-13364/): Raptive Ads <= 3.6.3 - Missing Authorization to Unauthenticated Data/Settings Reset (medium 5.3)
- [CVE-2024-13363](https://insights.sbomify.com/CVE-2024-13363/): Raptive Ads <= 3.6.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13362](https://insights.sbomify.com/CVE-2024-13362/): Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (medium 6.1)
- [CVE-2024-13361](https://insights.sbomify.com/CVE-2024-13361/): Missing authorization in AI Puffer – Your AI engine for WordPress (formerly AI Power) (medium 6.3)
- [CVE-2024-13360](https://insights.sbomify.com/CVE-2024-13360/): AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Subscriber+) Server-Side Request Forgery (medium 5.4)
- [CVE-2024-1336](https://insights.sbomify.com/CVE-2024-1336/): ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOn (medium 4.3)
- [CVE-2024-13359](https://insights.sbomify.com/CVE-2024-13359/): Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload (high 8.1)
- [CVE-2024-13358](https://insights.sbomify.com/CVE-2024-13358/): Missing authorization in BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages (medium 4.3)
- [CVE-2024-13357](https://insights.sbomify.com/CVE-2024-13357/): Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS (medium 4.8)
- [CVE-2024-13356](https://insights.sbomify.com/CVE-2024-13356/): DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion (medium 6.5)
- [CVE-2024-13355](https://insights.sbomify.com/CVE-2024-13355/): File upload in Admin and Customer Messages After Order for WooCommerce: OrderConvo (medium 5.4)
- [CVE-2024-13354](https://insights.sbomify.com/CVE-2024-13354/): Cross-site scripting in Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates (medium 6.4)
- [CVE-2024-13353](https://insights.sbomify.com/CVE-2024-13353/): Path traversal in Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates (high 8.8)
- [CVE-2024-13352](https://insights.sbomify.com/CVE-2024-13352/): Legull <= 1.2.2 - Reflected XSS (high 7.1)
- [CVE-2024-13351](https://insights.sbomify.com/CVE-2024-13351/): Social proof testimonials and reviews by Repuso <= 5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-13350](https://insights.sbomify.com/CVE-2024-13350/): SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1335](https://insights.sbomify.com/CVE-2024-1335/): ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimization (medium 4.3)
- [CVE-2024-13349](https://insights.sbomify.com/CVE-2024-13349/): Stockdio Historical Chart <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13347](https://insights.sbomify.com/CVE-2024-13347/): Essential WP Real Estate <= 1.1.3 - Reflected XSS (medium 6.8)
- [CVE-2024-13346](https://insights.sbomify.com/CVE-2024-13346/): Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-13345](https://insights.sbomify.com/CVE-2024-13345/): Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-13344](https://insights.sbomify.com/CVE-2024-13344/): Advance Seat Reservation Management for WooCommerce <= 3.3 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13343](https://insights.sbomify.com/CVE-2024-13343/): WooCommerce Customers Manager <= 31.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2024-13342](https://insights.sbomify.com/CVE-2024-13342/): Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload (high 8.1)
- [CVE-2024-13341](https://insights.sbomify.com/CVE-2024-13341/): MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-13340](https://insights.sbomify.com/CVE-2024-13340/): MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1334](https://insights.sbomify.com/CVE-2024-1334/): ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization (medium 4.3)
- [CVE-2024-13339](https://insights.sbomify.com/CVE-2024-13339/): DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-13338](https://insights.sbomify.com/CVE-2024-13338/): Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache (medium 5.3)
- [CVE-2024-13337](https://insights.sbomify.com/CVE-2024-13337/): Cross-site request forgery in Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/477/