2024 CVEs (page 12)
Page 12 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8094 | Medium | 6.5 | 2025-05-15 | The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-8090 | Medium | 6.1 | 2025-05-15 | The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow a… |
CVE-2024-8085 | Medium | 6.1 | 2025-05-15 | The PeoplePond WordPress plugin through 1.1.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attac… |
CVE-2024-8082 | Medium | 4.3 | 2025-05-15 | The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2024-8050 | Medium | 4.3 | 2025-05-15 | The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2024-8032 | Medium | 6.1 | 2025-05-15 | The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which cou… |
CVE-2024-8031 | Medium | 6.5 | 2025-05-15 | The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authentic… |
CVE-2024-8009 | Medium | 4.3 | 2025-05-15 | The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page |
CVE-2024-7984 | Medium | 4.3 | 2025-05-15 | The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2024-7769 | Medium | 4.8 | 2025-05-15 | The ClickSold IDX WordPress plugin through 1.90 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-7762 | Low | 3.7 | 2025-05-15 | The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthenticated users to access and download up… |
CVE-2024-7761 | Medium | 6.1 | 2025-05-15 | In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of t… |
CVE-2024-7759 | Medium | 4.8 | 2025-05-15 | The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-7758 | Medium | 4.8 | 2025-05-15 | The Stylish Price List WordPress plugin before 7.1.8 does not sanitise and escape some of its settings, which could allow high privilege users of contributor… |
CVE-2024-7556 | Medium | 4.8 | 2025-05-15 | The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-6809 | Critical | 9.8 | 2025-05-15 | The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX actio… |
CVE-2024-6798 | Medium | 4.8 | 2025-05-15 | The DL Verification WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-6797 | Medium | 4.8 | 2025-05-15 | The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-6719 | High | 8.1 | 2025-05-15 | The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update… |
CVE-2024-6718 | Medium | 5.4 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-6713 | Medium | 4.8 | 2025-05-15 | The PVN Auth Popup WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-6712 | Medium | 6.1 | 2025-05-15 | The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow at… |
CVE-2024-6711 | Low | 3.5 | 2025-05-15 | The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as… |
CVE-2024-6708 | Medium | 4.8 | 2025-05-15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which al… |
CVE-2024-6693 | Medium | 4.8 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-6690 | Medium | 6.1 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites |
CVE-2024-6668 | Medium | 5.4 | 2025-05-15 | The ProfilePro WordPress plugin through 1.3 does not sanitise and escape some parameters and lacks proper access controls, which could allow users with a role… |
CVE-2024-6667 | Medium | 6.1 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2024-6665 | Medium | 4.8 | 2025-05-15 | The KBucket: Your Curated Content in WordPress plugin before 4.1.6 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-6584 | Critical | 9.1 | 2025-05-15 | The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs. |
CVE-2024-6486 | High | 7.2 | 2025-05-15 | The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This… |
CVE-2024-6478 | Medium | 4.8 | 2025-05-15 | The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2024-6462 | Medium | 4.8 | 2025-05-15 | The DL Yandex Metrika WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-6335 | Medium | 4.8 | 2025-05-15 | The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2024-6159 | Critical | 9.8 | 2025-05-15 | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statemen… |
CVE-2024-5440 | Medium | 5.4 | 2025-05-15 | The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.3 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2024-5026 | Medium | 4.8 | 2025-05-15 | The CM Tooltip Glossary WordPress plugin before 4.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2024-4665 | Medium | 6.4 | 2025-05-15 | The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other… |
CVE-2024-4091 | Low | 3.5 | 2025-05-15 | The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2024-4004 | Low | 3.5 | 2025-05-15 | The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-4002 | Low | 3.5 | 2025-05-15 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2024-3996 | Low | 3.5 | 2025-05-15 | The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-3901 | Medium | 6.8 | 2025-05-15 | The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allow… |
CVE-2024-3062 | Medium | 4.8 | 2025-05-15 | The Save as Image Plugin by Pdfcrowd WordPress plugin before 3.2.2 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2024-2869 | Medium | 4.8 | 2025-05-15 | The Easy Property Listings WordPress plugin before 3.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-2643 | Medium | 4.8 | 2025-05-15 | The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.6.8 does not sanitise and esca… |
CVE-2024-1663 | Medium | 4.8 | 2025-05-15 | The Ultimate Noindex Nofollow Tool II WordPress plugin before 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users s… |
CVE-2024-13865 | Medium | 6.1 | 2025-05-15 | The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13828 | Medium | 6.1 | 2025-05-15 | The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13823 | Medium | 6.1 | 2025-05-15 | The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2024-13730 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13729 | Medium | 4.8 | 2025-05-15 | The Podlove Podcast Publisher WordPress plugin before 4.1.24 does not sanitise and escape some of its settings, which could allow high privilege users such as… |
CVE-2024-13727 | Medium | 6.1 | 2025-05-15 | The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-13621 | Medium | 4.8 | 2025-05-15 | The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-13619 | Medium | 6.1 | 2025-05-15 | The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-13616 | Medium | 4.8 | 2025-05-15 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.7.2 does not sanitise and escape some of its settings, which could allow high privilege use… |
CVE-2024-13486 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13482 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13384 | Medium | 4.8 | 2025-05-15 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.24 does not sanitise and escape some of its settings, which could allow high… |
CVE-2024-13383 | Medium | 4.8 | 2025-05-15 | The HD Quiz WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-13382 | Medium | 4.8 | 2025-05-15 | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-13357 | Medium | 4.8 | 2025-05-15 | The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform S… |
CVE-2024-13313 | Medium | 4.8 | 2025-05-15 | The AWeber WordPress plugin through 7.3.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-13128 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13127 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13053 | Medium | 4.8 | 2025-05-15 | The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-12874 | Medium | 4.8 | 2025-05-15 | The Top Comments WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2024-12873 | Medium | 6.1 | 2025-05-15 | The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2024-12812 | High | 7.5 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 is affected by an IDOR issue wh… |
CVE-2024-12808 | Medium | 4.8 | 2025-05-15 | The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting WordPress plugin before 1.13.4 does not sanitise and escape so… |
CVE-2024-12800 | Medium | 4.8 | 2025-05-15 | The IP Based Login WordPress plugin before 2.4.1 does not sanitise values when importing, which could allow high privilege users such as admin to perform Store… |
CVE-2024-12770 | Medium | 4.8 | 2025-05-15 | The WP ULike WordPress plugin before 4.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12767 | Low | 3.5 | 2025-05-15 | The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts |
CVE-2024-12750 | Medium | 4.3 | 2025-05-15 | The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-12743 | Medium | 4.8 | 2025-05-15 | The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-12739 | Medium | 4.8 | 2025-05-15 | The Mobile Contact Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-12735 | High | 7.2 | 2025-05-15 | The Advance Post Prefix WordPress plugin through 1.1.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins and above t… |
CVE-2024-12734 | Medium | 6.1 | 2025-05-15 | The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outp… |
CVE-2024-12733 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12732 | Medium | 6.1 | 2025-05-15 | The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2024-12726 | Medium | 6.1 | 2025-05-15 | The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scri… |
CVE-2024-12725 | Medium | 6.1 | 2025-05-15 | The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2024-12724 | Medium | 6.1 | 2025-05-15 | The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Si… |
CVE-2024-12722 | Medium | 5.4 | 2025-05-15 | The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before output… |
CVE-2024-12716 | Medium | 4.8 | 2025-05-15 | The Simple Basic Contact Form WordPress plugin before 20250114 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2024-12680 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-12679 | Medium | 4.8 | 2025-05-15 | The Prisna GWT WordPress plugin before 1.4.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2024-12301 | Medium | 6.5 | 2025-05-15 | The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwant… |
CVE-2024-12282 | Medium | 6.1 | 2025-05-15 | The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow at… |
CVE-2024-11843 | Medium | 4.8 | 2025-05-15 | The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2024-11719 | Medium | 6.1 | 2025-05-15 | The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow… |
CVE-2024-11718 | Medium | 5.4 | 2025-05-15 | The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contribut… |
CVE-2024-11502 | Medium | 5.4 | 2025-05-15 | The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2024-11373 | Medium | 4.3 | 2025-05-15 | The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2024-11372 | High | 7.2 | 2025-05-15 | The Connexion Logs WordPress plugin through 3.0.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL i… |
CVE-2024-11269 | High | 7.2 | 2025-05-15 | The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL inje… |
CVE-2024-11267 | High | 8.8 | 2025-05-15 | The JSP Store Locator WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing user with Contributor… |
CVE-2024-11266 | Medium | 4.8 | 2025-05-15 | The Geocache Stat Bar Widget WordPress plugin through 0.911 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-11221 | Medium | 4.8 | 2025-05-15 | The Full Screen (Page) Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privil… |
CVE-2024-11190 | Medium | 4.8 | 2025-05-15 | The jwp-a11y WordPress plugin through 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |