# Vulnerabilities published in 2024


- [CVE-2024-12461](https://insights.sbomify.com/CVE-2024-12461/): WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12460](https://insights.sbomify.com/CVE-2024-12460/): Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1246](https://insights.sbomify.com/CVE-2024-1246/): Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature (low 2.0)
- [CVE-2024-12459](https://insights.sbomify.com/CVE-2024-12459/): Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12458](https://insights.sbomify.com/CVE-2024-12458/): Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12457](https://insights.sbomify.com/CVE-2024-12457/): Cross-site scripting in Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode (medium 6.4)
- [CVE-2024-12454](https://insights.sbomify.com/CVE-2024-12454/): Affiliate Program Suite — SliceWP Affiliates <= 1.1.23 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12453](https://insights.sbomify.com/CVE-2024-12453/): Uptodown APK Download Widget <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12452](https://insights.sbomify.com/CVE-2024-12452/): Ziggeo <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12451](https://insights.sbomify.com/CVE-2024-12451/): HTML5 chat <= 1.07 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12450](https://insights.sbomify.com/CVE-2024-12450/): RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow (medium 6.5)
- [CVE-2024-1245](https://insights.sbomify.com/CVE-2024-1245/): Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes (low 2.4)
- [CVE-2024-12449](https://insights.sbomify.com/CVE-2024-12449/): Cross-site scripting in Video Share VOD – Turnkey Video Site Builder Script (medium 6.4)
- [CVE-2024-12448](https://insights.sbomify.com/CVE-2024-12448/): Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12447](https://insights.sbomify.com/CVE-2024-12447/): Missing authorization in Get Post Content Shortcode (medium 4.3)
- [CVE-2024-12446](https://insights.sbomify.com/CVE-2024-12446/): Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12445](https://insights.sbomify.com/CVE-2024-12445/): RightMessage WP <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12444](https://insights.sbomify.com/CVE-2024-12444/): WP Dispensary <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12443](https://insights.sbomify.com/CVE-2024-12443/): Cross-site scripting in CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout (medium 6.4)
- [CVE-2024-12442](https://insights.sbomify.com/CVE-2024-12442/): Command injection in EnerSys AMPA versions 24.04 through 24.16, inclusive (critical 9.8)
- [CVE-2024-12441](https://insights.sbomify.com/CVE-2024-12441/): BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12440](https://insights.sbomify.com/CVE-2024-12440/): Candifly <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1244](https://insights.sbomify.com/CVE-2024-1244/): Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft (critical 9.5)
- [CVE-2024-12439](https://insights.sbomify.com/CVE-2024-12439/): Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode (medium 6.4)
- [CVE-2024-12438](https://insights.sbomify.com/CVE-2024-12438/): WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket <= 4.75 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12437](https://insights.sbomify.com/CVE-2024-12437/): Marketplace Items <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-12436](https://insights.sbomify.com/CVE-2024-12436/): WP Customer Area <= 8.2.4 - Bulk Delete via CSRF (medium 4.3)
- [CVE-2024-12435](https://insights.sbomify.com/CVE-2024-12435/): Compare Products for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12434](https://insights.sbomify.com/CVE-2024-12434/): SureMembers <= 1.10.6 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-12433](https://insights.sbomify.com/CVE-2024-12433/): Remote Code Execution in infiniflow/ragflow (critical 9.8)
- [CVE-2024-12432](https://insights.sbomify.com/CVE-2024-12432/): WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key (high 8.1)
- [CVE-2024-12431](https://insights.sbomify.com/CVE-2024-12431/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2024-12430](https://insights.sbomify.com/CVE-2024-12430/): Command injection in AC500 V3 (high 7.3)
- [CVE-2024-1243](https://insights.sbomify.com/CVE-2024-1243/): Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft (critical 9.5)
- [CVE-2024-12429](https://insights.sbomify.com/CVE-2024-12429/): Path traversal in AC500 V3 (medium 5.1)
- [CVE-2024-12428](https://insights.sbomify.com/CVE-2024-12428/): WP Data Access – App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12427](https://insights.sbomify.com/CVE-2024-12427/): Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload (medium 5.3)
- [CVE-2024-12426](https://insights.sbomify.com/CVE-2024-12426/): URL fetching can be used to exfiltrate arbitrary INI file values and environment variables (medium 6.7)
- [CVE-2024-12425](https://insights.sbomify.com/CVE-2024-12425/): Path traversal leading to arbitrary .ttf file write (low 2.4)
- [CVE-2024-12423](https://insights.sbomify.com/CVE-2024-12423/): Contact Form 7 Redirect & Thank You Page <= 1.0.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12422](https://insights.sbomify.com/CVE-2024-12422/): Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12421](https://insights.sbomify.com/CVE-2024-12421/): Code injection in Coupon Affiliates – Affiliate Plugin for WooCommerce (medium 6.5)
- [CVE-2024-12420](https://insights.sbomify.com/CVE-2024-12420/): WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-1242](https://insights.sbomify.com/CVE-2024-1242/): Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12419](https://insights.sbomify.com/CVE-2024-12419/): Code injection in WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms (medium 6.5)
- [CVE-2024-12417](https://insights.sbomify.com/CVE-2024-12417/): Simple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-12416](https://insights.sbomify.com/CVE-2024-12416/): Woomotiv <= 3.6.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12415](https://insights.sbomify.com/CVE-2024-12415/): AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-12414](https://insights.sbomify.com/CVE-2024-12414/): Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-12413](https://insights.sbomify.com/CVE-2024-12413/): MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution <= 2.0.00 - Missing Authorization (medium 5.3)
- [CVE-2024-12412](https://insights.sbomify.com/CVE-2024-12412/): Cross-site scripting in Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment (medium 6.1)
- [CVE-2024-12411](https://insights.sbomify.com/CVE-2024-12411/): WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12410](https://insights.sbomify.com/CVE-2024-12410/): Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injection (medium 4.9)
- [CVE-2024-1241](https://insights.sbomify.com/CVE-2024-1241/): Watchdog Antivirus v1.6.415 - Denial of Service (medium 5.5)
- [CVE-2024-12409](https://insights.sbomify.com/CVE-2024-12409/): Simple:Press Forum <= 6.10.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12408](https://insights.sbomify.com/CVE-2024-12408/): WP on AWS <= 5.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12407](https://insights.sbomify.com/CVE-2024-12407/): Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12406](https://insights.sbomify.com/CVE-2024-12406/): Library Management System <= 3.2.0 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-12405](https://insights.sbomify.com/CVE-2024-12405/): Export Customers Data <= 1.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12404](https://insights.sbomify.com/CVE-2024-12404/): CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12403](https://insights.sbomify.com/CVE-2024-12403/): Image Gallery – Responsive Photo Gallery <= 1.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12402](https://insights.sbomify.com/CVE-2024-12402/): Auth bypass in TC Ecommerce – Create Android & iOS Apps for WooCommerce (critical 9.8)
- [CVE-2024-12401](https://insights.sbomify.com/CVE-2024-12401/): Cert-manager: potential dos when parsing specially crafted pem inputs (medium 4.4)
- [CVE-2024-12400](https://insights.sbomify.com/CVE-2024-12400/): Tourmaster < 5.3.5 - Reflected XSS (high 7.1)
- [CVE-2024-1240](https://insights.sbomify.com/CVE-2024-1240/): Open Redirection in pyload/pyload (medium 4.6)
- [CVE-2024-12399](https://insights.sbomify.com/CVE-2024-12399/): Other in Pro-face GP-Pro EX (medium 6.1)
- [CVE-2024-12398](https://insights.sbomify.com/CVE-2024-12398/): Privilege escalation in WBE530 firmware (high 8.8)
- [CVE-2024-12397](https://insights.sbomify.com/CVE-2024-12397/): Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling (high 7.4)
- [CVE-2024-12395](https://insights.sbomify.com/CVE-2024-12395/): WooCommerce Additional Fees On Checkout (Free) <= 1.4.7 - Reflected Cross-Site Scripting via 'number' (medium 6.1)
- [CVE-2024-12394](https://insights.sbomify.com/CVE-2024-12394/): Action Network <= 1.4.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12393](https://insights.sbomify.com/CVE-2024-12393/): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003 (medium 5.4)
- [CVE-2024-12392](https://insights.sbomify.com/CVE-2024-12392/): Server-Side Request Forgery (SSRF) in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-12391](https://insights.sbomify.com/CVE-2024-12391/): Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-12390](https://insights.sbomify.com/CVE-2024-12390/): Remote Code Execution in binary-husky/gpt_academic (high 8.8)
- [CVE-2024-1239](https://insights.sbomify.com/CVE-2024-1239/): ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12389](https://insights.sbomify.com/CVE-2024-12389/): Path Traversal in binary-husky/gpt_academic (high 8.8)
- [CVE-2024-12388](https://insights.sbomify.com/CVE-2024-12388/): Regular Expression Denial of Service (ReDoS) in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-12387](https://insights.sbomify.com/CVE-2024-12387/): Improper Input Validation in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-12386](https://insights.sbomify.com/CVE-2024-12386/): WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion (high 8.1)
- [CVE-2024-12385](https://insights.sbomify.com/CVE-2024-12385/): WP Abstracts <= 2.7.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12384](https://insights.sbomify.com/CVE-2024-12384/): Binary MLM Woocommerce <= 2.0 - Reflected Cross-Site Scripting via 'page' (medium 6.1)
- [CVE-2024-12383](https://insights.sbomify.com/CVE-2024-12383/): Binary MLM Woocommerce <= 2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12382](https://insights.sbomify.com/CVE-2024-12382/): Use after free in Chrome (high 8.8)
- [CVE-2024-12381](https://insights.sbomify.com/CVE-2024-12381/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-12380](https://insights.sbomify.com/CVE-2024-12380/): Generation of Error Message Containing Sensitive Information in GitLab (medium 4.4)
- [CVE-2024-1238](https://insights.sbomify.com/CVE-2024-1238/): ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12379](https://insights.sbomify.com/CVE-2024-12379/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-12378](https://insights.sbomify.com/CVE-2024-12378/): Information disclosure in CloudVision Portal (critical 9.1)
- [CVE-2024-12376](https://insights.sbomify.com/CVE-2024-12376/): Server Side Request Forgery in lm-sys/fastchat (high 7.5)
- [CVE-2024-12375](https://insights.sbomify.com/CVE-2024-12375/): Local File Inclusion in automatic1111/stable-diffusion-webui (medium 6.5)
- [CVE-2024-12374](https://insights.sbomify.com/CVE-2024-12374/): Stored XSS in automatic1111/stable-diffusion-webui (medium 6.1)
- [CVE-2024-12373](https://insights.sbomify.com/CVE-2024-12373/): Rockwell Automation PowerMonitor™ 1000 Denial of Service (critical 9.3)
- [CVE-2024-12372](https://insights.sbomify.com/CVE-2024-12372/): Rockwell Automation PowerMonitor™ 1000 Denial of Service (critical 9.3)
- [CVE-2024-12371](https://insights.sbomify.com/CVE-2024-12371/): Rockwell Automation PowerMonitor™ 1000 Remote Code Execution (critical 9.3)
- [CVE-2024-12370](https://insights.sbomify.com/CVE-2024-12370/): WP Hotel Booking <= 2.1.5 - Missing Authorization (medium 5.3)
- [CVE-2024-1237](https://insights.sbomify.com/CVE-2024-1237/): Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12369](https://insights.sbomify.com/CVE-2024-12369/): Elytron-oidc-client: oidc authorization code injection (medium 4.2)
- [CVE-2024-12368](https://insights.sbomify.com/CVE-2024-12368/): Missing authorization in Odoo Community (high 8.1)
- [CVE-2024-12367](https://insights.sbomify.com/CVE-2024-12367/): Information Disclosure in Vegagrup Software's Vega Master (high 8.6)
- [CVE-2024-12366](https://insights.sbomify.com/CVE-2024-12366/): CVE-2024-12366 (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/487/