Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 487 of 521.
- CVE-2024-12461 WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12460 Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1246 Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature
- CVE-2024-12459 Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12458 Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12457 Cross-site scripting in Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode
- CVE-2024-12454 Affiliate Program Suite — SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12453 Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12452 Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12451 HTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12450 RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow
- CVE-2024-1245 Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes
- CVE-2024-12449 Cross-site scripting in Video Share VOD – Turnkey Video Site Builder Script
- CVE-2024-12448 Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12447 Missing authorization in Get Post Content Shortcode
- CVE-2024-12446 Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12445 RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12444 WP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12443 Cross-site scripting in CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout
- CVE-2024-12442 Command injection in EnerSys AMPA versions 24.04 through 24.16, inclusive
- CVE-2024-12441 BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting
- CVE-2024-12440 Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1244 Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft
- CVE-2024-12439 Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode
- CVE-2024-12438 WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting
- CVE-2024-12437 Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-12436 WP Customer Area <= 8.2.4 - Bulk Delete via CSRF
- CVE-2024-12435 Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting
- CVE-2024-12434 SureMembers <= 1.10.6 - Sensitive Information Exposure
- CVE-2024-12433 Remote Code Execution in infiniflow/ragflow
- CVE-2024-12432 WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key
- CVE-2024-12431 Missing Authorization in GitLab
- CVE-2024-12430 Command injection in AC500 V3
- CVE-2024-1243 Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
- CVE-2024-12429 Path traversal in AC500 V3
- CVE-2024-12428 WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection
- CVE-2024-12427 Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload
- CVE-2024-12426 URL fetching can be used to exfiltrate arbitrary INI file values and environment variables
- CVE-2024-12425 Path traversal leading to arbitrary .ttf file write
- CVE-2024-12423 Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scripting
- CVE-2024-12422 Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting
- CVE-2024-12421 Code injection in Coupon Affiliates – Affiliate Plugin for WooCommerce
- CVE-2024-12420 WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-1242 Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12419 Code injection in WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms
- CVE-2024-12417 Simple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-12416 Woomotiv <= 3.6.1 - Unauthenticated SQL Injection
- CVE-2024-12415 AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-12414 Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery
- CVE-2024-12413 MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization
- CVE-2024-12412 Cross-site scripting in Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
- CVE-2024-12411 WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting
- CVE-2024-12410 Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection
- CVE-2024-1241 Watchdog Antivirus v1.6.415 - Denial of Service
- CVE-2024-12409 Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting
- CVE-2024-12408 WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting
- CVE-2024-12407 Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting
- CVE-2024-12406 Library Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-12405 Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting
- CVE-2024-12404 CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection
- CVE-2024-12403 Image Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scripting
- CVE-2024-12402 Auth bypass in TC Ecommerce – Create Android & iOS Apps for WooCommerce
- CVE-2024-12401 Cert-manager: potential dos when parsing specially crafted pem inputs
- CVE-2024-12400 Tourmaster < 5.3.5 - Reflected XSS
- CVE-2024-1240 Open Redirection in pyload/pyload
- CVE-2024-12399 Other in Pro-face GP-Pro EX
- CVE-2024-12398 Privilege escalation in WBE530 firmware
- CVE-2024-12397 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling
- CVE-2024-12395 WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number'
- CVE-2024-12394 Action Network <= 1.4.4 - Reflected Cross-Site Scripting
- CVE-2024-12393 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
- CVE-2024-12392 Server-Side Request Forgery (SSRF) in binary-husky/gpt_academic
- CVE-2024-12391 Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic
- CVE-2024-12390 Remote Code Execution in binary-husky/gpt_academic
- CVE-2024-1239 ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12389 Path Traversal in binary-husky/gpt_academic
- CVE-2024-12388 Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic
- CVE-2024-12387 Improper Input Validation in binary-husky/gpt_academic
- CVE-2024-12386 WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion
- CVE-2024-12385 WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12384 Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page'
- CVE-2024-12383 Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12382 Use after free in Chrome
- CVE-2024-12381 Memory corruption in Chrome
- CVE-2024-12380 Generation of Error Message Containing Sensitive Information in GitLab
- CVE-2024-1238 ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12379 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-12378 Information disclosure in CloudVision Portal
- CVE-2024-12376 Server Side Request Forgery in lm-sys/fastchat
- CVE-2024-12375 Local File Inclusion in automatic1111/stable-diffusion-webui
- CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui
- CVE-2024-12373 Rockwell Automation PowerMonitor™ 1000 Denial of Service
- CVE-2024-12372 Rockwell Automation PowerMonitor™ 1000 Denial of Service
- CVE-2024-12371 Rockwell Automation PowerMonitor™ 1000 Remote Code Execution
- CVE-2024-12370 WP Hotel Booking <= 2.1.5 - Missing Authorization
- CVE-2024-1237 Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12369 Elytron-oidc-client: oidc authorization code injection
- CVE-2024-12368 Missing authorization in Odoo Community
- CVE-2024-12367 Information Disclosure in Vegagrup Software's Vega Master
- CVE-2024-12366 CVE-2024-12366