2024 CVEs (page 12)
Page 12 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6335 | Medium | 4.8 | 2025-05-15 | The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-6159 | Critical | 9.8 | 2025-05-15 | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statemen… |
CVE-2024-5440 | Medium | 5.4 | 2025-05-15 | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2024-5026 | Medium | 4.8 | 2025-05-15 | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4665 | Medium | 6.4 | 2025-05-15 | The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other… |
CVE-2024-4091 | Low | 3.5 | 2025-05-15 | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4004 | Low | 3.5 | 2025-05-15 | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4002 | Low | 3.5 | 2025-05-15 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-3996 | Low | 3.5 | 2025-05-15 | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-3901 | Medium | 6.8 | 2025-05-15 | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allow… |
CVE-2024-3062 | Medium | 4.8 | 2025-05-15 | The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-2869 | Medium | 4.8 | 2025-05-15 | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-2643 | Medium | 4.8 | 2025-05-15 | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and esca… |
CVE-2024-1663 | Medium | 4.8 | 2025-05-15 | The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-13865 | Medium | 6.1 | 2025-05-15 | The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13828 | Medium | 6.1 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13823 | Medium | 6.1 | 2025-05-15 | The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-13730 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13729 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-13727 | Medium | 6.1 | 2025-05-15 | The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-13621 | Medium | 4.8 | 2025-05-15 | The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13619 | Medium | 6.1 | 2025-05-15 | The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13616 | Medium | 4.8 | 2025-05-15 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege use… |
CVE-2024-13486 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13482 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13384 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-13383 | Medium | 4.8 | 2025-05-15 | The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-13382 | Medium | 4.8 | 2025-05-15 | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-13357 | Medium | 4.8 | 2025-05-15 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-13313 | Medium | 4.8 | 2025-05-15 | The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-13128 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13127 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13053 | Medium | 4.8 | 2025-05-15 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12874 | Medium | 4.8 | 2025-05-15 | The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-12873 | Medium | 6.1 | 2025-05-15 | The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-12812 | High | 7.5 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue wh… |
CVE-2024-12808 | Medium | 4.8 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape so… |
CVE-2024-12800 | Medium | 4.8 | 2025-05-15 | The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Store… |
CVE-2024-12770 | Medium | 4.8 | 2025-05-15 | The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12767 | Low | 3.5 | 2025-05-15 | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts |
CVE-2024-12750 | Medium | 4.3 | 2025-05-15 | The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-12743 | Medium | 4.8 | 2025-05-15 | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12739 | Medium | 4.8 | 2025-05-15 | The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12735 | High | 7.2 | 2025-05-15 | The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above t… |
CVE-2024-12734 | Medium | 6.1 | 2025-05-15 | The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outp… |
CVE-2024-12733 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12732 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12726 | Medium | 6.1 | 2025-05-15 | The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scri… |
CVE-2024-12725 | Medium | 6.1 | 2025-05-15 | The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2024-12724 | Medium | 6.1 | 2025-05-15 | The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-12722 | Medium | 5.4 | 2025-05-15 | The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before output… |
CVE-2024-12716 | Medium | 4.8 | 2025-05-15 | The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-12680 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-12679 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-12301 | Medium | 6.5 | 2025-05-15 | The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwant… |
CVE-2024-12282 | Medium | 6.1 | 2025-05-15 | The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow at… |
CVE-2024-11843 | Medium | 4.8 | 2025-05-15 | The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11719 | Medium | 6.1 | 2025-05-15 | The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-11718 | Medium | 5.4 | 2025-05-15 | The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contribut… |
CVE-2024-11502 | Medium | 5.4 | 2025-05-15 | The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2024-11373 | Medium | 4.3 | 2025-05-15 | The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-11372 | High | 7.2 | 2025-05-15 | The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL i… |
CVE-2024-11269 | High | 7.2 | 2025-05-15 | The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL inje… |
CVE-2024-11267 | High | 8.8 | 2025-05-15 | The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor… |
CVE-2024-11266 | Medium | 4.8 | 2025-05-15 | The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-11221 | Medium | 4.8 | 2025-05-15 | The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-11190 | Medium | 4.8 | 2025-05-15 | The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11189 | Medium | 4.8 | 2025-05-15 | The Social Share And Social Locker WordPress plugin before 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2024-11141 | Medium | 6.1 | 2025-05-15 | The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscr… |
CVE-2024-11140 | Low | 3.5 | 2025-05-15 | The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2024-11109 | Medium | 4.8 | 2025-05-15 | The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10818 | Medium | 5.4 | 2025-05-15 | The JSFiddle Shortcode WordPress plugin before 1.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2024-10677 | Medium | 4.3 | 2025-05-15 | The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin cha… |
CVE-2024-10639 | Medium | 4.8 | 2025-05-15 | The Auto Prune Posts WordPress plugin before 3.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-10634 | Medium | 4.3 | 2025-05-15 | The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-10632 | Medium | 4.8 | 2025-05-15 | The Nokaut Offers Box WordPress plugin through 1.4.0 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to… |
CVE-2024-10631 | Medium | 6.5 | 2025-05-15 | The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them bac… |
CVE-2024-10504 | Medium | 5.4 | 2025-05-15 | The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the pag… |
CVE-2024-10475 | Medium | 4.8 | 2025-05-15 | The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow… |
CVE-2024-10362 | Medium | 4.8 | 2025-05-15 | The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.9.1 does not sanitize and escape some of its settings, which could allow high-p… |
CVE-2024-10149 | Medium | 4.8 | 2025-05-15 | The Social Slider Feed WordPress plugin before 2.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10145 | Medium | 4.8 | 2025-05-15 | The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10144 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-10143 | Medium | 4.8 | 2025-05-15 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10107 | Medium | 4.8 | 2025-05-15 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-10098 | Low | 2.7 | 2025-05-15 | The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them an… |
CVE-2024-10076 | Medium | 5.9 | 2025-05-15 | The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs… |
CVE-2024-10075 | Medium | 5.6 | 2025-05-15 | The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow u… |
CVE-2024-10054 | Medium | 4.8 | 2025-05-15 | The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-10009 | Medium | 4.1 | 2025-05-15 | The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perfor… |
CVE-2024-0970 | Medium | 5.3 | 2025-05-15 | This User Activity Tracking and Log WordPress plugin before 4.1.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to man… |
CVE-2024-0852 | High | 8.8 | 2025-05-15 | The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing… |
CVE-2024-0249 | High | 7.1 | 2025-05-15 | The Advanced Schedule Posts WordPress plugin through 2.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect… |
CVE-2024-56006 | Medium | 5.3 | 2025-05-15 | Missing Authorization vulnerability in Automattic Jetpack Debug Tools.This issue affects Jetpack Debug Tools: from n/a before 2.0.1. |
CVE-2024-51666 | Medium | 4.3 | 2025-05-15 | Missing Authorization vulnerability in Tosin Oguntuyi Tours tours.This issue affects Tours: from n/a through <= 1.0.0. |
CVE-2024-52880 | High | 7.9 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52879 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52878 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-52877 | High | 7.5 | 2025-05-15 | An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel… |
CVE-2024-13914 | High | 7.2 | 2025-05-15 | The File Manager Advanced Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.4 (file-manager-advanc… |