2024 CVEs (page 75)
Page 75 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-54114 | Medium | 4.4 | 2024-12-12 | Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54113 | Medium | 6.5 | 2024-12-12 | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption. |
CVE-2024-54112 | Medium | 5.5 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54111 | Medium | 5.7 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54110 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54109 | Medium | 6.5 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54108 | Medium | 6.5 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54107 | High | 7.1 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54106 | High | 7.1 | 2024-12-12 | Null pointer dereference vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54105 | Medium | 5.1 | 2024-12-12 | Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54104 | Medium | 6.2 | 2024-12-12 | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54103 | Medium | 6.1 | 2024-12-12 | Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54102 | Medium | 6.1 | 2024-12-12 | Race condition vulnerability in the DDR module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-54101 | Medium | 6.2 | 2024-12-12 | Denial of service (DoS) vulnerability in the installation module Impact: Successful exploitation of this vulnerability will affect availability. |
CVE-2024-54100 | Medium | 6.2 | 2024-12-12 | Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnorma… |
CVE-2024-54099 | Medium | 6.7 | 2024-12-12 | File replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2024-54098 | High | 8.5 | 2024-12-12 | Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2024-54097 | High | 7.3 | 2024-12-12 | Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity. |
CVE-2024-54096 | Medium | 5.3 | 2024-12-12 | Vulnerability of improper access control in the MTP module Impact: Successful exploitation of this vulnerability may affect integrity and accuracy. |
CVE-2024-12570 | Medium | 6.7 | 2024-12-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6… |
CVE-2024-12292 | Medium | 4.0 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-11274 | High | 8.7 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-10043 | Low | 3.1 | 2024-12-12 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions s… |
CVE-2024-21574 | Critical | 10.0 | 2024-12-12 | The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is add… |
CVE-2024-12401 | Medium | 4.4 | 2024-12-12 | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resour… |
CVE-2024-12397 | High | 7.4 | 2024-12-12 | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an att… |
CVE-2024-12333 | Medium | 6.5 | 2024-12-12 | The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowi… |
CVE-2024-12160 | Medium | 6.1 | 2024-12-12 | The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app… |
CVE-2024-11760 | Medium | 6.4 | 2024-12-12 | The Currency Converter Widget ⚡ PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'currency-converter-widget-pro' shortcod… |
CVE-2024-12564 | | 2024-12-12 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability was discovered in Open Design Alliance CDE inWEB SDK before 2025.3. Installing CDE Ser… | |
CVE-2024-12329 | Medium | 4.3 | 2024-12-12 | The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in al… |
CVE-2024-12312 | High | 8.1 | 2024-12-12 | The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untr… |
CVE-2024-12201 | Medium | 4.3 | 2024-12-12 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles… |
CVE-2024-11727 | Medium | 4.4 | 2024-12-12 | The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPr… |
CVE-2024-11724 | Medium | 4.3 | 2024-12-12 | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unaut… |
CVE-2024-11181 | Medium | 4.3 | 2024-12-12 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via… |
CVE-2024-10784 | Medium | 6.4 | 2024-12-12 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery'… |
CVE-2024-10583 | Medium | 5.4 | 2024-12-12 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-9881 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-9641 | Medium | 4.8 | 2024-12-12 | The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-9428 | Medium | 4.8 | 2024-12-12 | The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-12265 | Medium | 5.3 | 2024-12-12 | The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /w… |
CVE-2024-12263 | Medium | 4.3 | 2024-12-12 | The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_dele… |
CVE-2024-12255 | Medium | 5.3 | 2024-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf… |
CVE-2024-12172 | High | 7.5 | 2024-12-12 | The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access d… |
CVE-2024-12072 | Medium | 6.1 | 2024-12-12 | The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app… |
CVE-2024-12059 | Medium | 4.3 | 2024-12-12 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via th… |
CVE-2024-12040 | High | 8.8 | 2024-12-12 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1… |
CVE-2024-12018 | Medium | 4.3 | 2024-12-12 | The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including… |
CVE-2024-11882 | Medium | 6.4 | 2024-12-12 | The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fa… |
CVE-2024-11871 | Medium | 6.4 | 2024-12-12 | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'patreon' shortcode in all versions up to, and i… |
CVE-2024-11785 | Medium | 6.4 | 2024-12-12 | The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'firebase_show' shortcode in all versions up to, and… |
CVE-2024-11781 | Medium | 6.4 | 2024-12-12 | The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in… |
CVE-2024-11766 | Medium | 6.4 | 2024-12-12 | The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2024-11765 | Medium | 6.4 | 2024-12-12 | The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Si… |
CVE-2024-11757 | Medium | 6.4 | 2024-12-12 | The WP GeoNames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-geonames' shortcode in all versions up to, and including… |
CVE-2024-11359 | Medium | 6.1 | 2024-12-12 | The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-11052 | High | 7.2 | 2024-12-12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter… |
CVE-2024-10637 | Medium | 5.4 | 2024-12-12 | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back i… |
CVE-2024-10568 | Medium | 4.7 | 2024-12-12 | The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10518 | Medium | 4.8 | 2024-12-12 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise a… |
CVE-2024-10517 | Medium | 4.8 | 2024-12-12 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise a… |
CVE-2024-10499 | High | 7.2 | 2024-12-12 | The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allo… |
CVE-2024-10124 | Critical | 9.8 | 2024-12-12 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation… |
CVE-2024-10010 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-12526 | Medium | 4.3 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1… |
CVE-2024-12463 | Medium | 6.4 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_embed_amp' shortcod… |
CVE-2024-12441 | Medium | 6.1 | 2024-12-12 | The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-12406 | Medium | 6.5 | 2024-12-12 | The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in… |
CVE-2024-12162 | Medium | 6.1 | 2024-12-12 | The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up… |
CVE-2024-12156 | Medium | 6.1 | 2024-12-12 | The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in… |
CVE-2024-11891 | Medium | 6.4 | 2024-12-12 | The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to… |
CVE-2024-11875 | Medium | 6.4 | 2024-12-12 | The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to… |
CVE-2024-11804 | Medium | 6.1 | 2024-12-12 | The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to… |
CVE-2024-11750 | Medium | 6.4 | 2024-12-12 | The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up t… |
CVE-2024-11723 | Medium | 6.1 | 2024-12-12 | The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidx_listings_sitemap_ranges, kvco… |
CVE-2024-11709 | Medium | 4.3 | 2024-12-12 | The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_gen… |
CVE-2024-11459 | Medium | 6.1 | 2024-12-12 | The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter in all versions up to, and including, 3.2 due t… |
CVE-2024-11410 | Medium | 6.4 | 2024-12-12 | The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-11384 | Medium | 6.4 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in a… |
CVE-2024-10910 | High | 7.3 | 2024-12-12 | The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all… |
CVE-2024-10590 | High | 8.8 | 2024-12-12 | The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all ver… |
CVE-2024-10182 | Medium | 6.4 | 2024-12-12 | The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to i… |
CVE-2024-12461 | Medium | 6.4 | 2024-12-12 | The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprevive_async' shortcode in all versions up to, and… |
CVE-2024-12341 | Medium | 4.3 | 2024-12-12 | The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_… |
CVE-2024-12338 | Medium | 6.1 | 2024-12-12 | The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions… |
CVE-2024-12260 | Medium | 6.1 | 2024-12-12 | The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and i… |
CVE-2024-12258 | Medium | 6.1 | 2024-12-12 | The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up… |
CVE-2024-11914 | Medium | 6.4 | 2024-12-12 | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attire-blocks/post-carousel' b… |
CVE-2024-11901 | Medium | 6.4 | 2024-12-12 | The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to… |
CVE-2024-11689 | High | 8.8 | 2024-12-12 | The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or… |
CVE-2024-11683 | Medium | 6.1 | 2024-12-12 | The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all versions up to, and inc… |
CVE-2024-11443 | High | 8.8 | 2024-12-12 | The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-11442 | Medium | 6.4 | 2024-12-12 | The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' sh… |
CVE-2024-11433 | Medium | 6.4 | 2024-12-12 | The Surbma | SalesAutopilot Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sa-form' shortcode in all versions up… |
CVE-2024-11430 | Medium | 6.5 | 2024-12-12 | The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the 'arg1' arg of the 'gvn_schart_2' shortcode in all versions up to, and includi… |
CVE-2024-11427 | Medium | 6.4 | 2024-12-12 | The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catch-popup' shortcode in all versions up to, and including… |
CVE-2024-11419 | Medium | 6.1 | 2024-12-12 | The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incor… |
CVE-2024-11417 | Medium | 6.1 | 2024-12-12 | The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due t… |
CVE-2024-11413 | Medium | 6.4 | 2024-12-12 | The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all v… |