2024 CVEs (page 55)
Page 55 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-9697 | Medium | 5.3 | 2025-01-07 | The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the twee… |
CVE-2024-9638 | Medium | 4.8 | 2025-01-07 | The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-8857 | Medium | 4.8 | 2025-01-07 | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as edi… |
CVE-2024-8855 | Critical | 9.8 | 2025-01-07 | The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and abo… |
CVE-2024-7696 | Medium | 6.3 | 2025-01-07 | Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log… |
CVE-2024-12849 | High | 7.5 | 2025-01-07 | The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_… |
CVE-2024-12633 | High | 7.1 | 2025-01-07 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page parameter… |
CVE-2024-12535 | High | 8.6 | 2025-01-07 | The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in… |
CVE-2024-12471 | High | 8.8 | 2025-01-07 | The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads… |
CVE-2024-12464 | Medium | 6.4 | 2025-01-07 | The Chatroll Live Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chatroll' shortcode in all versions up to, and inclu… |
CVE-2024-12440 | Medium | 6.4 | 2025-01-07 | The Candifly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'candifly' shortcode in all versions up to, and including, 1.0… |
CVE-2024-12439 | Medium | 6.4 | 2025-01-07 | The Marketplace Items plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'marketplace' shortcode in all versions up to, and inc… |
CVE-2024-12438 | Medium | 6.1 | 2025-01-07 | The WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'start_date’ an… |
CVE-2024-12384 | Medium | 6.1 | 2025-01-07 | The Binary MLM Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page’ parameter in all versions up to, and including… |
CVE-2024-12383 | Medium | 6.1 | 2025-01-07 | The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing o… |
CVE-2024-12261 | Medium | 6.1 | 2025-01-07 | The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and inclu… |
CVE-2024-12073 | Medium | 6.4 | 2025-01-07 | The Meteor Slides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slide_url_value' parameter in all versions up to, and including, 1… |
CVE-2024-11887 | Medium | 6.4 | 2025-01-07 | The Geo Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'geotargetlygeocontent' shortcode in all versions up to, and… |
CVE-2024-11756 | Medium | 6.4 | 2025-01-07 | The SweepWidget Contests, Giveaways, Photo Contests, Competitions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sweepwidg… |
CVE-2024-11749 | Medium | 6.4 | 2025-01-07 | The App Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appizy' shortcode in all versions up to, and including, 2.3.2… |
CVE-2024-11606 | Medium | 5.3 | 2025-01-07 | The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2024-11369 | Medium | 6.1 | 2025-01-07 | The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'start_date', and 'end_dat… |
CVE-2024-10562 | Low | 2.7 | 2025-01-07 | The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2024-10536 | Medium | 4.3 | 2025-01-07 | The FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized acc… |
CVE-2024-10102 | Low | 2.7 | 2025-01-07 | The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could al… |
CVE-2024-9208 | Medium | 6.1 | 2025-01-07 | The Enable Accessibility plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without approp… |
CVE-2024-12470 | Critical | 9.8 | 2025-01-07 | The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to… |
CVE-2024-12462 | Medium | 6.4 | 2025-01-07 | The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and includ… |
CVE-2024-12457 | Medium | 6.4 | 2025-01-07 | The Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-12453 | Medium | 6.4 | 2025-01-07 | The Uptodown APK Download Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'utd-widget' shortcode in all versions up t… |
CVE-2024-12445 | Medium | 6.4 | 2025-01-07 | The RightMessage WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rm_area' shortcode in all versions up to, and including… |
CVE-2024-12435 | Medium | 6.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘s_feature’ parameter in all versions up to… |
CVE-2024-12332 | Medium | 6.5 | 2025-01-07 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including… |
CVE-2024-12327 | Medium | 4.3 | 2025-01-07 | The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_set… |
CVE-2024-12324 | Medium | 6.1 | 2025-01-07 | The Unilevel MLM Plan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 1.1.0… |
CVE-2024-12322 | High | 8.8 | 2025-01-07 | The ThePerfectWedding.nl Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8. This is due to miss… |
CVE-2024-12313 | High | 8.1 | 2025-01-07 | The Compare Products for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.1 via deserialization… |
CVE-2024-12291 | Medium | 6.1 | 2025-01-07 | The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.17. This is due to missing or incor… |
CVE-2024-12290 | Medium | 6.1 | 2025-01-07 | The Infility Global plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘set_type’ parameter in all versions up to, and including, 2.9… |
CVE-2024-12288 | Medium | 6.1 | 2025-01-07 | The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to miss… |
CVE-2024-12264 | Critical | 9.8 | 2025-01-07 | The PayU CommercePro Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.8.3. This is due to /wp-json/pay… |
CVE-2024-12256 | Medium | 6.1 | 2025-01-07 | The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analytics_video' parameter in all versions up… |
CVE-2024-12252 | Critical | 9.8 | 2025-01-07 | The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remote_update AJAX action in all versions u… |
CVE-2024-12214 | Medium | 6.1 | 2025-01-07 | The WooCommerce HSS Extension for Streaming Video plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘videolink’ parameter in all ver… |
CVE-2024-12207 | Medium | 4.4 | 2025-01-07 | The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and inclu… |
CVE-2024-12176 | Medium | 5.3 | 2025-01-07 | The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'wl_config_plugin' AJ… |
CVE-2024-12170 | Medium | 5.4 | 2025-01-07 | The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incor… |
CVE-2024-12159 | Medium | 5.3 | 2025-01-07 | The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, a… |
CVE-2024-12158 | Medium | 5.3 | 2025-01-07 | The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability… |
CVE-2024-12157 | High | 7.5 | 2025-01-07 | The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'upc_dele… |
CVE-2024-12153 | Medium | 6.1 | 2025-01-07 | The GDY Modular Content plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-12140 | Medium | 4.3 | 2025-01-07 | The Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements plugin for WordPress is vulnerable to Information Exposure in all versions up… |
CVE-2024-12126 | Medium | 6.1 | 2025-01-07 | The SEO Keywords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘google_error’ parameter in all versions up to, and including, 1… |
CVE-2024-12049 | Medium | 6.1 | 2025-01-07 | The Woo Ukrposhta plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order', 'post', and 'idd' parameters in all versions up to, and… |
CVE-2024-11810 | Medium | 6.1 | 2025-01-07 | The PayGreen Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message_id' parameter in all versions up to, and inc… |
CVE-2024-11690 | Medium | 6.1 | 2025-01-07 | The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter in all versions up… |
CVE-2024-11496 | Medium | 6.5 | 2025-01-07 | The Infility Global plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the infility_global_ajax funct… |
CVE-2024-11465 | High | 7.2 | 2025-01-07 | The Custom Product Tabs for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserializat… |
CVE-2024-11445 | Medium | 6.4 | 2025-01-07 | The Image Magnify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_magnify' shortcode in all versions up to, and inclu… |
CVE-2024-11434 | Medium | 6.1 | 2025-01-07 | The WP – Bulk SMS – by SMS.to plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-11383 | Medium | 6.4 | 2025-01-07 | The CC Canadian Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cc-mortgage-canada' shortcode in all ve… |
CVE-2024-11382 | Medium | 6.4 | 2025-01-07 | The Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-11378 | Medium | 6.1 | 2025-01-07 | The Bizapp for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'error' parameter in all versions up to, and including… |
CVE-2024-11377 | Medium | 6.1 | 2025-01-07 | The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and inclu… |
CVE-2024-11375 | Medium | 6.1 | 2025-01-07 | The WC1C plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all ve… |
CVE-2024-11363 | Medium | 6.1 | 2025-01-07 | The Same but Different – Related Posts by Taxonomy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remov… |
CVE-2024-11338 | Medium | 6.4 | 2025-01-07 | The PIXNET Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtm' and 'venue' parameters in all versions up to, and including… |
CVE-2024-11337 | Medium | 6.4 | 2025-01-07 | The Horoscope And Tarot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'divine_horoscope' shortcode in all versions up to… |
CVE-2024-11290 | Medium | 5.3 | 2025-01-07 | The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core searc… |
CVE-2024-10527 | Low | 3.1 | 2025-01-07 | The Spacer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the motech_spacer_callback() function in all… |
CVE-2024-12592 | Medium | 6.4 | 2025-01-07 | The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3… |
CVE-2024-12590 | Medium | 6.4 | 2025-01-07 | The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due t… |
CVE-2024-12559 | Medium | 5.3 | 2025-01-07 | The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and th… |
CVE-2024-12557 | Medium | 6.1 | 2025-01-07 | The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce… |
CVE-2024-12541 | Medium | 5.4 | 2025-01-07 | The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to mi… |
CVE-2024-12538 | Medium | 4.3 | 2025-01-07 | The Duplicate Post, Page and Any Custom Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.5 v… |
CVE-2024-12528 | Medium | 6.4 | 2025-01-07 | The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp… |
CVE-2024-12419 | Medium | 6.5 | 2025-01-07 | The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions u… |
CVE-2024-12416 | High | 7.5 | 2025-01-07 | The Live Sales Notification for Woocommerce – Woomotiv plugin for WordPress is vulnerable to SQL Injection via the 'woomotiv_seen_products_.*' cookie in all ve… |
CVE-2024-12402 | Critical | 9.8 | 2025-01-07 | The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all v… |
CVE-2024-12098 | Medium | 6.1 | 2025-01-07 | The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and i… |
CVE-2024-11934 | Medium | 6.4 | 2025-01-07 | The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' s… |
CVE-2024-11899 | Medium | 6.4 | 2025-01-07 | The Slider Pro Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sliderpro' shortcode in all versions up to, and includi… |
CVE-2024-11777 | Medium | 6.4 | 2025-01-07 | The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions… |
CVE-2024-11437 | Medium | 4.9 | 2025-01-07 | The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient e… |
CVE-2024-55553 | High | 7.5 | 2025-01-06 | In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffe… |
CVE-2024-54767 | High | 7.5 | 2025-01-06 | An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authenticati… |
CVE-2024-54764 | Medium | 6.5 | 2025-01-06 | An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. |
CVE-2024-54763 | Medium | 6.5 | 2025-01-06 | An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. |
CVE-2024-53936 | Medium | 6.3 | 2025-01-06 | The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissions) to place phone… |
CVE-2024-53935 | Medium | 6.5 | 2025-01-06 | The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (with no permissions) t… |
CVE-2024-53934 | High | 7.7 | 2025-01-06 | The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables any application (w… |
CVE-2024-53933 | Medium | 6.3 | 2025-01-06 | The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any application (with no pe… |
CVE-2024-53932 | Critical | 9.1 | 2025-01-06 | The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (… |
CVE-2024-53931 | Critical | 9.1 | 2025-01-06 | The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place p… |
CVE-2024-51741 | Medium | 4.4 | 2025-01-06 | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when… |
CVE-2024-48457 | High | 7.5 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-48456 | High | 7.5 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-48455 | Low | 2.7 | 2025-01-06 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3… |
CVE-2024-46981 | High | 7.0 | 2025-01-06 | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage colle… |