2024 CVEs (page 142)
Page 142 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-10080 | Medium | 6.4 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post meta in versions up to, and including, 1.4.4 due to insuffici… |
CVE-2024-10079 | High | 8.8 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted inpu… |
CVE-2024-10078 | Medium | 6.3 | 2024-10-18 | The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple… |
CVE-2024-10055 | Medium | 6.4 | 2024-10-18 | The Click to Chat – WP Support All-in-One Floating Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsaio_snapchat sh… |
CVE-2024-9703 | Medium | 6.4 | 2024-10-18 | The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and includi… |
CVE-2024-9206 | Medium | 6.1 | 2024-10-18 | The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate e… |
CVE-2024-47793 | Medium | 5.4 | 2024-10-18 | Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. When accessing the edit screen containing custom… |
CVE-2024-46897 | Low | 3.8 | 2024-10-18 | Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in user with the permi… |
CVE-2024-38820 | Low | 3.1 | 2024-10-18 | The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions th… |
CVE-2024-9892 | Medium | 4.4 | 2024-10-18 | The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 d… |
CVE-2024-9848 | Medium | 6.4 | 2024-10-18 | The Product Customizer Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0… |
CVE-2024-9452 | Medium | 6.4 | 2024-10-18 | The Branding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficie… |
CVE-2024-9383 | Medium | 6.1 | 2024-10-18 | The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due… |
CVE-2024-9382 | Medium | 6.1 | 2024-10-18 | The Gantry 4 Framework plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'override_id' parameter in all versions up to, and includin… |
CVE-2024-9373 | Medium | 6.4 | 2024-10-18 | The Elemenda plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.0.2 due to insuffic… |
CVE-2024-9366 | Medium | 6.4 | 2024-10-18 | The Easy Menu Manager | WPZest plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0… |
CVE-2024-9364 | Medium | 4.3 | 2024-10-18 | The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_mailplus_clear_logs' fu… |
CVE-2024-9361 | Medium | 4.3 | 2024-10-18 | The Bulk images optimizer: Resize, optimize, convert to webp, rename … plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2024-9350 | Medium | 6.1 | 2024-10-18 | The DPD Baltic Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_value' parameter in all versions up to, and includ… |
CVE-2024-8916 | Medium | 6.4 | 2024-10-18 | The Suki Sites Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to… |
CVE-2024-8790 | Medium | 6.1 | 2024-10-18 | The Social Share With Floating Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-8740 | Medium | 6.1 | 2024-10-18 | The GetResponse Forms by Optin Cat plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate esc… |
CVE-2024-10119 | Critical | 9.8 | 2024-10-18 | The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system comma… |
CVE-2024-10049 | Medium | 6.1 | 2024-10-18 | The Edit WooCommerce Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and includi… |
CVE-2024-10040 | Medium | 5.3 | 2024-10-18 | The Infinite-Scroll plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or inc… |
CVE-2024-10014 | Medium | 6.4 | 2024-10-18 | The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient inpu… |
CVE-2024-9264 | Critical | 9.9 | 2024-10-18 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanit… |
CVE-2024-10118 | Critical | 9.8 | 2024-10-18 | SECOM WRTR-304GN-304TW-UPSC does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability… |
CVE-2024-49023 | Medium | 5.9 | 2024-10-18 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43596 | Medium | 6.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43595 | Medium | 6.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43587 | Medium | 5.9 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43580 | Medium | 5.4 | 2024-10-17 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2024-43579 | High | 7.6 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43578 | High | 7.6 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-43566 | High | 7.5 | 2024-10-17 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2024-10093 | High | 7.8 | 2024-10-17 | A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the f… |
CVE-2024-7316 | Medium | 5.9 | 2024-10-17 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker to cause Denial of… |
CVE-2024-33453 | High | 8.1 | 2024-10-17 | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component. |
CVE-2024-30875 | High | 7.1 | 2024-10-17 | Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2024-27766 | Medium | 5.7 | 2024-10-17 | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function. NOTE: this is disputed by the MariaDB Found… |
CVE-2024-48924 | | 2024-10-17 | ### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker th… | |
CVE-2024-49288 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce emai… |
CVE-2024-49283 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS… |
CVE-2024-49282 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows S… |
CVE-2024-49281 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Fl… |
CVE-2024-49280 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Re… |
CVE-2024-49279 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-bloc… |
CVE-2024-49278 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This… |
CVE-2024-49277 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-eleme… |
CVE-2024-49276 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cliogrow Clio Grow clio-grow-form allows Reflected XSS.Th… |
CVE-2024-49264 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-e… |
CVE-2024-49263 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows Stored… |
CVE-2024-49262 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wepic Country Flags for Elementor allows Stored XS… |
CVE-2024-49261 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks.This issue affects Arkhe Bl… |
CVE-2024-49259 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for… |
CVE-2024-49255 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Store… |
CVE-2024-49248 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.Th… |
CVE-2024-7755 | High | 8.2 | 2024-10-17 | The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the cr… |
CVE-2024-49319 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awes… |
CVE-2024-49316 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer al… |
CVE-2024-49311 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Stored XSS… |
CVE-2024-49310 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-add… |
CVE-2024-49309 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omarfolghe Digitally digitally allows Reflected XSS.This… |
CVE-2024-49308 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows… |
CVE-2024-49307 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended… |
CVE-2024-49302 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gall… |
CVE-2024-49301 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Sto… |
CVE-2024-49298 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate… |
CVE-2024-49296 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-ca… |
CVE-2024-49295 | Medium | 5.9 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimoni… |
CVE-2024-49292 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-… |
CVE-2024-49289 | Medium | 6.5 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This is… |
CVE-2024-10101 | Medium | 5.4 | 2024-10-17 | A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which rende… |
CVE-2024-10100 | High | 7.5 | 2024-10-17 | A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is… |
CVE-2024-10099 | Medium | 6.1 | 2024-10-17 | A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacke… |
CVE-2024-49400 | Critical | 9.8 | 2024-10-17 | Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured al… |
CVE-2024-49322 | Critical | 9.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress jemployee allows Privilege Escalation.This issue affects Job Boar… |
CVE-2024-49318 | Critical | 9.8 | 2024-10-17 | Deserialization of Untrusted Data vulnerability in Scott My Reading Library my-reading-library allows Object Injection.This issue affects My Reading Library: f… |
CVE-2024-49317 | High | 7.5 | 2024-10-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows… |
CVE-2024-49314 | Critical | 10.0 | 2024-10-17 | Unrestricted Upload of File with Dangerous Type vulnerability in jiangqie JiangQie Free Mini Program jiangqie-free-mini-program allows Upload a Web Shell to a… |
CVE-2024-49313 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: f… |
CVE-2024-49312 | Medium | 4.9 | 2024-10-17 | Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge.This issue affects Edwiser Bridge: from n/a through <= 3.0.7. |
CVE-2024-49305 | Critical | 9.3 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Email Verification for WooCommerce emails-verif… |
CVE-2024-49304 | Medium | 5.4 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking Syst… |
CVE-2024-49299 | High | 7.6 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Surfer Surfer surferseo allows SQL Injection.This issue a… |
CVE-2024-49297 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL In… |
CVE-2024-49291 | Critical | 10.0 | 2024-10-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0. |
CVE-2024-49287 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltu… |
CVE-2024-49285 | High | 7.5 | 2024-10-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local Fi… |
CVE-2024-49284 | Medium | 5.3 | 2024-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BogdanFix WP SendFox wp-sendfox allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-49246 | Critical | 9.3 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login ajax-rating-with-cu… |
CVE-2024-49244 | High | 8.5 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc… |
CVE-2024-49237 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n… |
CVE-2024-49235 | High | 7.5 | 2024-10-17 | Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Re… |
CVE-2024-49229 | High | 7.1 | 2024-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arifnezami Better Author Bio better-author-bio allows Ref… |
CVE-2024-49223 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change H… |
CVE-2024-49221 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a throug… |
CVE-2024-49220 | High | 7.1 | 2024-10-17 | Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: fro… |
CVE-2024-49219 | High | 8.8 | 2024-10-17 | Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1… |