# Vulnerabilities published in 2024


- [CVE-2024-13336](https://insights.sbomify.com/CVE-2024-13336/): Disable Auto Updates <= 1.4 - Cross-Site Request Forgery to Auto-update Disable (medium 4.3)
- [CVE-2024-13335](https://insights.sbomify.com/CVE-2024-13335/): Missing authorization in Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor (medium 4.3)
- [CVE-2024-13334](https://insights.sbomify.com/CVE-2024-13334/): Car Demon <= 1.8.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13333](https://insights.sbomify.com/CVE-2024-13333/): Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2024-13332](https://insights.sbomify.com/CVE-2024-13332/): TransFinanz <= 1.0.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13331](https://insights.sbomify.com/CVE-2024-13331/): WP Dream Carousel <= 1.0.1b - Reflected XSS (medium 6.1)
- [CVE-2024-13330](https://insights.sbomify.com/CVE-2024-13330/): Justrows Free <= 0.2 - Reflected XSS (high 7.1)
- [CVE-2024-1333](https://insights.sbomify.com/CVE-2024-1333/): Responsive Pricing Table < 5.1.11 - Author+ Stored XSS (medium 5.4)
- [CVE-2024-13329](https://insights.sbomify.com/CVE-2024-13329/): Solidres <= 0.9.4 - Reflected XSS (high 7.1)
- [CVE-2024-13328](https://insights.sbomify.com/CVE-2024-13328/): Giga Messenger Bots <= 2.3.1 - Reflected XSS (medium 6.1)
- [CVE-2024-13327](https://insights.sbomify.com/CVE-2024-13327/): Musicbox <= 2.0.3 - Reflected XSS (medium 6.1)
- [CVE-2024-13326](https://insights.sbomify.com/CVE-2024-13326/): iBuildApp <= 0.2.0 - Reflected XSS (medium 6.1)
- [CVE-2024-13325](https://insights.sbomify.com/CVE-2024-13325/): Glossy <= 2.3.5 - Reflected XSS (medium 6.1)
- [CVE-2024-13323](https://insights.sbomify.com/CVE-2024-13323/): Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode (medium 6.4)
- [CVE-2024-13322](https://insights.sbomify.com/CVE-2024-13322/): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.88 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13321](https://insights.sbomify.com/CVE-2024-13321/): AnalyticsWP <= 2.0.0 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-13320](https://insights.sbomify.com/CVE-2024-13320/): CURCY - WooCommerce Multi Currency - Currency Switcher <= 2.3.6 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-1332](https://insights.sbomify.com/CVE-2024-1332/): Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13319](https://insights.sbomify.com/CVE-2024-13319/): Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-13318](https://insights.sbomify.com/CVE-2024-13318/): Essential WP Real Estate <= 1.1.3 - Missing Authorization to Arbitrary Post/Page Deletion (medium 5.3)
- [CVE-2024-13317](https://insights.sbomify.com/CVE-2024-13317/): ShipWorks Connector for Woocommerce <= 5.2.5 - Cross-Site Request Forgery to Service Password/Username Update (medium 4.3)
- [CVE-2024-13316](https://insights.sbomify.com/CVE-2024-13316/): Scratch & Win – Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation (medium 5.3)
- [CVE-2024-13315](https://insights.sbomify.com/CVE-2024-13315/): Cross-site request forgery in Shopwarden – Automated WooCommerce monitoring & testing (high 8.8)
- [CVE-2024-13314](https://insights.sbomify.com/CVE-2024-13314/): Carousel, Slider, Gallery by WP Carousel < 2.7.4 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-13313](https://insights.sbomify.com/CVE-2024-13313/): AWeber <= 7.3.20 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-13312](https://insights.sbomify.com/CVE-2024-13312/): Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076 (medium 5.3)
- [CVE-2024-13311](https://insights.sbomify.com/CVE-2024-13311/): Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075 (high 7.3)
- [CVE-2024-13310](https://insights.sbomify.com/CVE-2024-13310/): Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074 (medium 6.5)
- [CVE-2024-1331](https://insights.sbomify.com/CVE-2024-1331/): Team Members < 5.3.2 - Author+ Stored XSS (medium 6.1)
- [CVE-2024-13309](https://insights.sbomify.com/CVE-2024-13309/): Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073 (medium 5.4)
- [CVE-2024-13308](https://insights.sbomify.com/CVE-2024-13308/): Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072 (low 3.8)
- [CVE-2024-13307](https://insights.sbomify.com/CVE-2024-13307/): Missing authorization in Reales WP - Real Estate WordPress Theme (medium 5.3)
- [CVE-2024-13306](https://insights.sbomify.com/CVE-2024-13306/): WP Google Map < 1.9.4 - Admin+ Stored XSS (medium 4.3)
- [CVE-2024-13305](https://insights.sbomify.com/CVE-2024-13305/): Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071 (medium 4.8)
- [CVE-2024-13304](https://insights.sbomify.com/CVE-2024-13304/): Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070 (medium 4.5)
- [CVE-2024-13303](https://insights.sbomify.com/CVE-2024-13303/): Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069 (medium 5.3)
- [CVE-2024-13302](https://insights.sbomify.com/CVE-2024-13302/): Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 (medium 5.3)
- [CVE-2024-13301](https://insights.sbomify.com/CVE-2024-13301/): OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067 (medium 6.1)
- [CVE-2024-13300](https://insights.sbomify.com/CVE-2024-13300/): Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066 (medium 6.6)
- [CVE-2024-1330](https://insights.sbomify.com/CVE-2024-1330/): Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access (medium 4.3)
- [CVE-2024-13299](https://insights.sbomify.com/CVE-2024-13299/): Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065 (medium 6.6)
- [CVE-2024-13298](https://insights.sbomify.com/CVE-2024-13298/): Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064 (medium 4.8)
- [CVE-2024-13297](https://insights.sbomify.com/CVE-2024-13297/): Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063 (medium 6.6)
- [CVE-2024-13296](https://insights.sbomify.com/CVE-2024-13296/): Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062 (medium 6.6)
- [CVE-2024-13295](https://insights.sbomify.com/CVE-2024-13295/): Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061 (medium 6.6)
- [CVE-2024-13294](https://insights.sbomify.com/CVE-2024-13294/): POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060 (medium 5.4)
- [CVE-2024-13293](https://insights.sbomify.com/CVE-2024-13293/): POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059 (low 3.1)
- [CVE-2024-13292](https://insights.sbomify.com/CVE-2024-13292/): Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058 (medium 4.8)
- [CVE-2024-13291](https://insights.sbomify.com/CVE-2024-13291/): Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057 (high 7.3)
- [CVE-2024-13290](https://insights.sbomify.com/CVE-2024-13290/): OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056 (medium 5.3)
- [CVE-2024-1329](https://insights.sbomify.com/CVE-2024-1329/): Nomad Vulnerable to Arbitrary Write Through Symlink Attack (high 7.7)
- [CVE-2024-13289](https://insights.sbomify.com/CVE-2024-13289/): Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055 (medium 5.4)
- [CVE-2024-13288](https://insights.sbomify.com/CVE-2024-13288/): Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052 (medium 4.3)
- [CVE-2024-13287](https://insights.sbomify.com/CVE-2024-13287/): Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051 (medium 5.4)
- [CVE-2024-13286](https://insights.sbomify.com/CVE-2024-13286/): SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050 (medium 5.4)
- [CVE-2024-13285](https://insights.sbomify.com/CVE-2024-13285/): wkhtmltopdf - Highly critical - Unsupported - SA-CONTRIB-2024-049 (critical 9.8)
- [CVE-2024-13284](https://insights.sbomify.com/CVE-2024-13284/): Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048 (high 8.8)
- [CVE-2024-13283](https://insights.sbomify.com/CVE-2024-13283/): Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047 (medium 6.1)
- [CVE-2024-13282](https://insights.sbomify.com/CVE-2024-13282/): Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046 (high 8.8)
- [CVE-2024-13281](https://insights.sbomify.com/CVE-2024-13281/): Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045 (critical 9.1)
- [CVE-2024-13280](https://insights.sbomify.com/CVE-2024-13280/): Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044 (critical 9.8)
- [CVE-2024-1328](https://insights.sbomify.com/CVE-2024-1328/): Newsletter2Go <= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style (medium 6.4)
- [CVE-2024-13279](https://insights.sbomify.com/CVE-2024-13279/): Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043 (critical 9.8)
- [CVE-2024-13278](https://insights.sbomify.com/CVE-2024-13278/): Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042 (critical 9.1)
- [CVE-2024-13277](https://insights.sbomify.com/CVE-2024-13277/): Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041 (critical 9.1)
- [CVE-2024-13276](https://insights.sbomify.com/CVE-2024-13276/): File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040 (high 7.5)
- [CVE-2024-13275](https://insights.sbomify.com/CVE-2024-13275/): Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039 (medium 5.3)
- [CVE-2024-13274](https://insights.sbomify.com/CVE-2024-13274/): Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038 (medium 5.3)
- [CVE-2024-13273](https://insights.sbomify.com/CVE-2024-13273/): Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037 (medium 5.4)
- [CVE-2024-13272](https://insights.sbomify.com/CVE-2024-13272/): Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036 (medium 6.3)
- [CVE-2024-13271](https://insights.sbomify.com/CVE-2024-13271/): Content Entity Clone - Moderately critical - Information Disclosure - SA-CONTRIB-2024-035 (medium 4.3)
- [CVE-2024-13270](https://insights.sbomify.com/CVE-2024-13270/): Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2024-034 (medium 4.3)
- [CVE-2024-1327](https://insights.sbomify.com/CVE-2024-1327/): Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box (medium 6.4)
- [CVE-2024-13269](https://insights.sbomify.com/CVE-2024-13269/): Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033 (medium 5.3)
- [CVE-2024-13268](https://insights.sbomify.com/CVE-2024-13268/): Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032 (medium 6.8)
- [CVE-2024-13267](https://insights.sbomify.com/CVE-2024-13267/): Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031 (high 7.5)
- [CVE-2024-13266](https://insights.sbomify.com/CVE-2024-13266/): Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030 (medium 5.3)
- [CVE-2024-13265](https://insights.sbomify.com/CVE-2024-13265/): Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029 (high 7.5)
- [CVE-2024-13264](https://insights.sbomify.com/CVE-2024-13264/): Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028 (critical 9.8)
- [CVE-2024-13263](https://insights.sbomify.com/CVE-2024-13263/): Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027 (medium 5.5)
- [CVE-2024-13262](https://insights.sbomify.com/CVE-2024-13262/): View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026 (medium 4.8)
- [CVE-2024-13261](https://insights.sbomify.com/CVE-2024-13261/): Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025 (low 3.5)
- [CVE-2024-13260](https://insights.sbomify.com/CVE-2024-13260/): Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024 (high 8.8)
- [CVE-2024-1326](https://insights.sbomify.com/CVE-2024-1326/): Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (medium 6.4)
- [CVE-2024-13259](https://insights.sbomify.com/CVE-2024-13259/): Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023 (high 7.5)
- [CVE-2024-13258](https://insights.sbomify.com/CVE-2024-13258/): Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022 (critical 9.8)
- [CVE-2024-13257](https://insights.sbomify.com/CVE-2024-13257/): Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021 (medium 5.3)
- [CVE-2024-13256](https://insights.sbomify.com/CVE-2024-13256/): Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020 (high 7.5)
- [CVE-2024-13255](https://insights.sbomify.com/CVE-2024-13255/): RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019 (high 7.5)
- [CVE-2024-13254](https://insights.sbomify.com/CVE-2024-13254/): REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018 (high 7.5)
- [CVE-2024-13253](https://insights.sbomify.com/CVE-2024-13253/): Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017 (critical 9.1)
- [CVE-2024-13252](https://insights.sbomify.com/CVE-2024-13252/): TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016 (medium 5.4)
- [CVE-2024-13251](https://insights.sbomify.com/CVE-2024-13251/): Registration role - Critical - Access bypass - SA-CONTRIB-2024-015 (high 8.8)
- [CVE-2024-13250](https://insights.sbomify.com/CVE-2024-13250/): Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014 (high 8.8)
- [CVE-2024-1325](https://insights.sbomify.com/CVE-2024-1325/): Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review (medium 4.3)
- [CVE-2024-13249](https://insights.sbomify.com/CVE-2024-13249/): Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013 (medium 5.4)
- [CVE-2024-13248](https://insights.sbomify.com/CVE-2024-13248/): Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012 (medium 5.5)
- [CVE-2024-13247](https://insights.sbomify.com/CVE-2024-13247/): Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011 (medium 4.8)
- [CVE-2024-13246](https://insights.sbomify.com/CVE-2024-13246/): Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010 (medium 5.3)
- [CVE-2024-13245](https://insights.sbomify.com/CVE-2024-13245/): CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009 (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/478/