2024 CVEs (page 54)
Page 54 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52366 | Medium | 5.9 | 2025-01-07 | IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly e… |
CVE-2024-12711 | Medium | 5.3 | 2025-01-07 | The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_d… |
CVE-2024-12532 | Medium | 4.3 | 2025-01-07 | The BWD Elementor Addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.18 in widgets/bwdeb-con… |
CVE-2024-12425 | Low | 3.3 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Document Foundation LibreOffice allows Absolute Path Traver… |
CVE-2024-12316 | Medium | 5.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_popup_action() function in… |
CVE-2024-12033 | Medium | 4.3 | 2025-01-07 | The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the sync_libraries() function in all versions… |
CVE-2024-11826 | Medium | 6.4 | 2025-01-07 | The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for… |
CVE-2024-56300 | High | 7.5 | 2025-01-07 | Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Re… |
CVE-2024-56299 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pektsekye Notify Odoo notify-odoo allows Stored XSS.This… |
CVE-2024-56298 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob @ 5 Star Plugins Pretty Simple Popup Builder pretty-s… |
CVE-2024-56297 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Highlight highlight allows Stored XSS.This i… |
CVE-2024-56296 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang Board WP mangboard allows Reflected XSS.T… |
CVE-2024-56294 | Medium | 6.4 | 2025-01-07 | Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-56293 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integ… |
CVE-2024-56292 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored X… |
CVE-2024-56291 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from… |
CVE-2024-56290 | Critical | 9.3 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in silverplugins217 Multiple Shipping And Billing Address Fo… |
CVE-2024-56289 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adrian Tobey Groundhogg groundhogg allows Reflected XSS.T… |
CVE-2024-56288 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Docs wp-docs allows Stored XSS.This issu… |
CVE-2024-56287 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows S… |
CVE-2024-56286 | High | 7.5 | 2025-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Classic Addons – WPBakery Page Builder classic-a… |
CVE-2024-56285 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2024-56284 | Critical | 9.3 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sslplugins SSL Wireless SMS Notification ssl-wireless-sms… |
CVE-2024-56283 | High | 8.1 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Lo… |
CVE-2024-56282 | High | 7.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elicus WPMozo Addons Lite for Elemento… |
CVE-2024-56281 | High | 7.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woo… |
CVE-2024-56280 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Privilege Escalation.This issue affects WPGuppy: from n/… |
CVE-2024-56279 | Medium | 6.4 | 2025-01-07 | Server-Side Request Forgery (SSRF) vulnerability in mra13 Compact WP Audio Player compact-wp-audio-player allows Server Side Request Forgery.This issue affects… |
CVE-2024-56278 | Critical | 9.1 | 2025-01-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows PHP Remote File I… |
CVE-2024-56276 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-56275 | Medium | 4.1 | 2025-01-07 | Server-Side Request Forgery (SSRF) vulnerability in Envato Envato Elements allows Server Side Request Forgery.This issue affects Envato Elements: from n/a thro… |
CVE-2024-56274 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-56273 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allows Accessing Functionality Not Properly Constraine… |
CVE-2024-56271 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in SecureSubmit WP SecureSubmit securesubmit allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-51715 | High | 8.5 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickWhale ClickWhale clickwhale allows Blind SQL Injecti… |
CVE-2024-51700 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS… |
CVE-2024-51651 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-49649 | Critical | 9.8 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-… |
CVE-2024-49644 | High | 8.8 | 2025-01-07 | Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Acces… |
CVE-2024-49633 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designinvento DirectoryPress directorypress allows Reflec… |
CVE-2024-49294 | Medium | 4.3 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Cros… |
CVE-2024-49249 | High | 8.6 | 2025-01-07 | Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a… |
CVE-2024-49222 | Critical | 9.8 | 2025-01-07 | Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a… |
CVE-2024-43243 | Critical | 10.0 | 2025-01-07 | Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This… |
CVE-2024-12719 | Medium | 4.3 | 2025-01-07 | The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subf… |
CVE-2024-12699 | Medium | 6.4 | 2025-01-07 | The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insufficient input sanitizat… |
CVE-2024-12152 | High | 7.5 | 2025-01-07 | The MIPL WC Multisite Sync plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.5 via the 'mipl_wc_sync_download… |
CVE-2024-54030 | Medium | 4.4 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free. |
CVE-2024-47398 | High | 8.8 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write. |
CVE-2024-45070 | Medium | 5.5 | 2025-01-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read. |
CVE-2024-12516 | Medium | 6.4 | 2025-01-07 | The Coupon Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Coupon Code' parameter in all versions up to, and including, 1.2.1… |
CVE-2024-12202 | High | 8.8 | 2025-01-07 | The Croma Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-12077 | Medium | 6.1 | 2025-01-07 | The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all ver… |
CVE-2024-11627 | Medium | 6.8 | 2025-01-07 | : Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, fro… |
CVE-2024-11626 | High | 8.4 | 2025-01-07 | Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitef… |
CVE-2024-11625 | High | 7.7 | 2025-01-07 | Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.81… |
CVE-2024-10866 | Medium | 5.3 | 2025-01-07 | The Export Import Menus plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dsp_export_import_menus() fu… |
CVE-2024-9502 | Medium | 6.4 | 2025-01-07 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2024-9354 | Medium | 6.1 | 2025-01-07 | The Estatik Mortgage Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'color' parameter in all versions up to, and inclu… |
CVE-2024-12781 | Medium | 4.3 | 2025-01-07 | The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-12624 | Medium | 6.4 | 2025-01-07 | The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up… |
CVE-2024-12499 | Medium | 6.4 | 2025-01-07 | The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and includ… |
CVE-2024-12495 | Medium | 6.4 | 2025-01-07 | The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up… |
CVE-2024-12437 | Medium | 6.4 | 2025-01-07 | The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'envato' shortcode in all versions up to, and includin… |
CVE-2024-11764 | Medium | 6.4 | 2025-01-07 | The Solar Wizard Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'solar_wizard' shortcode in all versions up to, and in… |
CVE-2024-11725 | High | 8.8 | 2025-01-07 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation d… |
CVE-2024-11282 | Medium | 5.3 | 2025-01-07 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4… |
CVE-2024-9702 | Medium | 6.4 | 2025-01-07 | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode… |
CVE-2024-9697 | Medium | 5.3 | 2025-01-07 | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the twee… |
CVE-2024-9638 | Medium | 4.8 | 2025-01-07 | The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-8857 | Medium | 4.8 | 2025-01-07 | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as edi… |
CVE-2024-8855 | Critical | 9.8 | 2025-01-07 | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and abo… |
CVE-2024-7696 | Medium | 6.3 | 2025-01-07 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log… |
CVE-2024-12849 | High | 7.5 | 2025-01-07 | The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_… |
CVE-2024-12633 | High | 7.1 | 2025-01-07 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter… |
CVE-2024-12535 | High | 8.6 | 2025-01-07 | The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in… |
CVE-2024-12471 | High | 8.8 | 2025-01-07 | The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads… |
CVE-2024-12464 | Medium | 6.4 | 2025-01-07 | The Chatroll Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chatroll' shortcode in all versions up to, and inclu… |
CVE-2024-12440 | Medium | 6.4 | 2025-01-07 | The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0… |
CVE-2024-12439 | Medium | 6.4 | 2025-01-07 | The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and inc… |
CVE-2024-12438 | Medium | 6.1 | 2025-01-07 | The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ an… |
CVE-2024-12384 | Medium | 6.1 | 2025-01-07 | The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including… |
CVE-2024-12383 | Medium | 6.1 | 2025-01-07 | The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing o… |
CVE-2024-12261 | Medium | 6.1 | 2025-01-07 | The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and inclu… |
CVE-2024-12073 | Medium | 6.4 | 2025-01-07 | The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up to, and including, 1… |
CVE-2024-11887 | Medium | 6.4 | 2025-01-07 | The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and… |
CVE-2024-11756 | Medium | 6.4 | 2025-01-07 | The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidg… |
CVE-2024-11749 | Medium | 6.4 | 2025-01-07 | The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in all versions up to, and including, 2.3.2… |
CVE-2024-11606 | Medium | 5.3 | 2025-01-07 | The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-11369 | Medium | 6.1 | 2025-01-07 | The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'start_date', and 'end_dat… |
CVE-2024-10562 | Low | 2.7 | 2025-01-07 | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10536 | Medium | 4.3 | 2025-01-07 | The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized acc… |
CVE-2024-10102 | Low | 2.7 | 2025-01-07 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could al… |
CVE-2024-9208 | Medium | 6.1 | 2025-01-07 | The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without approp… |
CVE-2024-12470 | Critical | 9.8 | 2025-01-07 | The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to… |
CVE-2024-12462 | Medium | 6.4 | 2025-01-07 | The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and includ… |
CVE-2024-12457 | Medium | 6.4 | 2025-01-07 | The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-12453 | Medium | 6.4 | 2025-01-07 | The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up t… |
CVE-2024-12445 | Medium | 6.4 | 2025-01-07 | The RightMessage WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rm_area' shortcode in all versions up to, and including… |
CVE-2024-12435 | Medium | 6.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s_feature’ parameter in all versions up to… |