Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 478 of 521.
- CVE-2024-13336 Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable
- CVE-2024-13335 Missing authorization in Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor
- CVE-2024-13334 Car Demon <= 1.8.1 - Reflected Cross-Site Scripting
- CVE-2024-13333 Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-13332 TransFinanz <= 1.0.0 - Reflected XSS
- CVE-2024-13331 WP Dream Carousel <= 1.0.1b - Reflected XSS
- CVE-2024-13330 Justrows Free <= 0.2 - Reflected XSS
- CVE-2024-1333 Responsive Pricing Table < 5.1.11 - Author+ Stored XSS
- CVE-2024-13329 Solidres <= 0.9.4 - Reflected XSS
- CVE-2024-13328 Giga Messenger Bots <= 2.3.1 - Reflected XSS
- CVE-2024-13327 Musicbox <= 2.0.3 - Reflected XSS
- CVE-2024-13326 iBuildApp <= 0.2.0 - Reflected XSS
- CVE-2024-13325 Glossy <= 2.3.5 - Reflected XSS
- CVE-2024-13323 Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode
- CVE-2024-13322 Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection
- CVE-2024-13321 AnalyticsWP <= 2.0.0 - Unauthenticated SQL Injection
- CVE-2024-13320 CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection
- CVE-2024-1332 Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-13319 Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
- CVE-2024-13318 Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion
- CVE-2024-13317 ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update
- CVE-2024-13316 Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation
- CVE-2024-13315 Cross-site request forgery in Shopwarden – Automated WooCommerce monitoring & testing
- CVE-2024-13314 Carousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSS
- CVE-2024-13313 AWeber <= 7.3.20 - Admin+ Stored XSS
- CVE-2024-13312 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076
- CVE-2024-13311 Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075
- CVE-2024-13310 Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074
- CVE-2024-1331 Team Members < 5.3.2 - Author+ Stored XSS
- CVE-2024-13309 Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073
- CVE-2024-13308 Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072
- CVE-2024-13307 Missing authorization in Reales WP - Real Estate WordPress Theme
- CVE-2024-13306 WP Google Map < 1.9.4 - Admin+ Stored XSS
- CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071
- CVE-2024-13304 Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070
- CVE-2024-13303 Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069
- CVE-2024-13302 Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068
- CVE-2024-13301 OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067
- CVE-2024-13300 Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066
- CVE-2024-1330 Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access
- CVE-2024-13299 Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065
- CVE-2024-13298 Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064
- CVE-2024-13297 Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063
- CVE-2024-13296 Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062
- CVE-2024-13295 Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061
- CVE-2024-13294 POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060
- CVE-2024-13293 POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059
- CVE-2024-13292 Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058
- CVE-2024-13291 Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057
- CVE-2024-13290 OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056
- CVE-2024-1329 Nomad Vulnerable to Arbitrary Write Through Symlink Attack
- CVE-2024-13289 Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055
- CVE-2024-13288 Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052
- CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051
- CVE-2024-13286 SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050
- CVE-2024-13285 wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049
- CVE-2024-13284 Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048
- CVE-2024-13283 Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047
- CVE-2024-13282 Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046
- CVE-2024-13281 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
- CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044
- CVE-2024-1328 Newsletter2Go <= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style
- CVE-2024-13279 Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043
- CVE-2024-13278 Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042
- CVE-2024-13277 Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041
- CVE-2024-13276 File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040
- CVE-2024-13275 Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
- CVE-2024-13274 Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
- CVE-2024-13273 Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037
- CVE-2024-13272 Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036
- CVE-2024-13271 Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035
- CVE-2024-13270 Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034
- CVE-2024-1327 Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box
- CVE-2024-13269 Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033
- CVE-2024-13268 Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032
- CVE-2024-13267 Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
- CVE-2024-13266 Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
- CVE-2024-13265 Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
- CVE-2024-13264 Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
- CVE-2024-13263 Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027
- CVE-2024-13262 View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026
- CVE-2024-13261 Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025
- CVE-2024-13260 Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024
- CVE-2024-1326 Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
- CVE-2024-13259 Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023
- CVE-2024-13258 Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022
- CVE-2024-13257 Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021
- CVE-2024-13256 Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
- CVE-2024-13255 RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019
- CVE-2024-13254 REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018
- CVE-2024-13253 Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017
- CVE-2024-13252 TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
- CVE-2024-13251 Registration role - Critical - Access bypass - SA-CONTRIB-2024-015
- CVE-2024-13250 Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014
- CVE-2024-1325 Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review
- CVE-2024-13249 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
- CVE-2024-13248 Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
- CVE-2024-13247 Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
- CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
- CVE-2024-13245 CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009