2024 CVEs (page 73)
Page 73 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54315 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-e… |
CVE-2024-54314 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for… |
CVE-2024-54313 | Medium | 6.5 | 2024-12-13 | Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25. |
CVE-2024-54312 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce… |
CVE-2024-54311 | Medium | 5.4 | 2024-12-13 | Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2024-54310 | Medium | 5.3 | 2024-12-13 | Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu gou-wc-account-tabs allows Accessing Functionality Not Properly Constrained… |
CVE-2024-54309 | Medium | 6.5 | 2024-12-13 | Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue aff… |
CVE-2024-54308 | Medium | 5.9 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Cryptocurrency Price Widget cryptocurrency-pri… |
CVE-2024-54307 | Medium | 4.3 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a throu… |
CVE-2024-54306 | Medium | 4.3 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Req… |
CVE-2024-54305 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtexpress J&T Express Malaysia jt-express allows Reflecte… |
CVE-2024-54304 | High | 8.5 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hive Support Hive Support hive-support allows SQL Injecti… |
CVE-2024-54303 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Refl… |
CVE-2024-54302 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This is… |
CVE-2024-54301 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS… |
CVE-2024-54300 | Medium | 4.3 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Cross Site Request Forgery.This issue affects… |
CVE-2024-54299 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allo… |
CVE-2024-54298 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2024-54297 | Critical | 9.8 | 2024-12-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBS… |
CVE-2024-54296 | Critical | 9.8 | 2024-12-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects… |
CVE-2024-54295 | Critical | 9.8 | 2024-12-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypas… |
CVE-2024-54294 | Critical | 9.8 | 2024-12-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase a… |
CVE-2024-54293 | Critical | 9.8 | 2024-12-13 | Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0. |
CVE-2024-54292 | Critical | 9.3 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This i… |
CVE-2024-54290 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflec… |
CVE-2024-54289 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-54288 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LDD Web Design LDD Directory Lite ldd-directory-lite allo… |
CVE-2024-54287 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-… |
CVE-2024-54286 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This… |
CVE-2024-54282 | High | 7.2 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <… |
CVE-2024-54278 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained… |
CVE-2024-54277 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based… |
CVE-2024-54276 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS… |
CVE-2024-54275 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wibergsweb CSV to html csv-to-html allows Reflected XSS.T… |
CVE-2024-54274 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin… |
CVE-2024-54273 | Critical | 9.8 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through… |
CVE-2024-54272 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS… |
CVE-2024-54271 | Medium | 5.4 | 2024-12-13 | Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-54268 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2024-54267 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-54266 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagere… |
CVE-2024-54265 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with In… |
CVE-2024-54264 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-sh… |
CVE-2024-54262 | Critical | 9.9 | 2024-12-13 | Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell t… |
CVE-2024-54261 | Critical | 10.0 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-… |
CVE-2024-54259 | Medium | 6.5 | 2024-12-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issu… |
CVE-2024-54258 | High | 8.5 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection… |
CVE-2024-54256 | High | 7.1 | 2024-12-13 | Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2024-54252 | Medium | 6.3 | 2024-12-13 | Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2024-54250 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows… |
CVE-2024-54248 | High | 8.8 | 2024-12-13 | Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom… |
CVE-2024-54246 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects F… |
CVE-2024-54245 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue aff… |
CVE-2024-54244 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This… |
CVE-2024-54243 | Medium | 6.5 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affec… |
CVE-2024-54242 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-54241 | Medium | 6.5 | 2024-12-13 | Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Con… |
CVE-2024-54240 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-on… |
CVE-2024-54239 | Critical | 9.8 | 2024-12-13 | Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear pre… |
CVE-2024-54238 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webde… |
CVE-2024-54237 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS… |
CVE-2024-54236 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocomm… |
CVE-2024-54235 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-wooc… |
CVE-2024-54234 | Critical | 9.3 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempt… |
CVE-2024-54233 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by Italy… |
CVE-2024-54231 | High | 7.1 | 2024-12-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-or… |
CVE-2024-47984 | Medium | 4.4 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could potentially exploit this vulnerability… |
CVE-2024-28980 | Medium | 6.5 | 2024-12-13 | Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker… |
CVE-2024-24902 | Medium | 6.6 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local attacker could potentially exploit this… |
CVE-2024-55889 | Medium | 4.9 | 2024-12-13 | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can tri… |
CVE-2024-48008 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vu… |
CVE-2024-48007 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit… |
CVE-2024-38488 | Medium | 6.5 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attack… |
CVE-2024-22461 | High | 8.8 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vu… |
CVE-2024-11986 | Critical | 9.6 | 2024-12-13 | Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the log… |
CVE-2024-9608 | Medium | 6.1 | 2024-12-13 | The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in al… |
CVE-2024-21577 | Critical | 10.0 | 2024-12-13 | ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-contro… |
CVE-2024-21576 | Critical | 10.0 | 2024-12-13 | ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour c… |
CVE-2024-11827 | Medium | 6.4 | 2024-12-13 | The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ootb_query shortcode in all versions up… |
CVE-2024-52066 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service) allows Overflow Variables an… |
CVE-2024-52065 | High | 7.1 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional on non-Windows (Persistence Service) allows Bu… |
CVE-2024-52064 | High | 7.1 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and… |
CVE-2024-52063 | High | 8.6 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Routing Service) allows Overf… |
CVE-2024-52062 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and… |
CVE-2024-52061 | Critical | 9.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core Libraries, Queuing Service, Recording Se… |
CVE-2024-52060 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routing Service, Recording Service, Queuing S… |
CVE-2024-52059 | High | 7.8 | 2024-12-13 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext… |
CVE-2024-52058 | High | 7.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext Professional (System Designer) allows O… |
CVE-2024-9290 | Critical | 9.8 | 2024-12-13 | The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a missing… |
CVE-2024-52057 | Critical | 9.8 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Professional (Queuing Service) allows SQL Inj… |
CVE-2024-11012 | Medium | 6.3 | 2024-12-13 | The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njt_nofi_text AJAX action in all versi… |
CVE-2024-10783 | High | 8.1 | 2024-12-13 | The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missi… |
CVE-2024-12465 | Medium | 6.4 | 2024-12-13 | The Property Hive Stamp Duty Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stamp_duty_calculator_scotland' sho… |
CVE-2024-12421 | Medium | 6.5 | 2024-12-13 | The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2024-12420 | Medium | 6.5 | 2024-12-13 | The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includ… |
CVE-2024-12417 | Medium | 6.5 | 2024-12-13 | The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to t… |
CVE-2024-12414 | Medium | 4.3 | 2024-12-13 | The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing… |
CVE-2024-12309 | Medium | 5.3 | 2024-12-13 | The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2024-12042 | Medium | 5.4 | 2024-12-13 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload… |
CVE-2024-11911 | Medium | 4.3 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin(… |