2024 CVEs (page 75)
Page 75 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-12201 | Medium | 4.3 | 2024-12-12 | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles… |
CVE-2024-11727 | Medium | 4.4 | 2024-12-12 | The NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar plugin for WordPr… |
CVE-2024-11724 | Medium | 4.3 | 2024-12-12 | The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) plugin for WordPress is vulnerable to unaut… |
CVE-2024-11181 | Medium | 4.3 | 2024-12-12 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 9.9.9.3 via… |
CVE-2024-10784 | Medium | 6.4 | 2024-12-12 | The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Tile Gallery'… |
CVE-2024-10583 | Medium | 5.4 | 2024-12-12 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-9881 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-9641 | Medium | 4.8 | 2024-12-12 | The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2024-9428 | Medium | 4.8 | 2024-12-12 | The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-12265 | Medium | 5.3 | 2024-12-12 | The Web3 Crypto Payments by DePay for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /w… |
CVE-2024-12263 | Medium | 4.3 | 2024-12-12 | The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_dele… |
CVE-2024-12255 | Medium | 5.3 | 2024-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5 via the cf… |
CVE-2024-12172 | High | 7.5 | 2024-12-12 | The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access d… |
CVE-2024-12072 | Medium | 6.1 | 2024-12-12 | The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without app… |
CVE-2024-12059 | Medium | 4.3 | 2024-12-12 | The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via th… |
CVE-2024-12040 | High | 8.8 | 2024-12-12 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1… |
CVE-2024-12018 | Medium | 4.3 | 2024-12-12 | The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including… |
CVE-2024-11882 | Medium | 6.4 | 2024-12-12 | The FAQ And Answers – Create Frequently Asked Questions Area on WP Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fa… |
CVE-2024-11871 | Medium | 6.4 | 2024-12-12 | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'patreon' shortcode in all versions up to, and i… |
CVE-2024-11785 | Medium | 6.4 | 2024-12-12 | The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'firebase_show' shortcode in all versions up to, and… |
CVE-2024-11781 | Medium | 6.4 | 2024-12-12 | The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartagenda' shortcode in… |
CVE-2024-11766 | Medium | 6.4 | 2024-12-12 | The WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2024-11765 | Medium | 6.4 | 2024-12-12 | The WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more plugin for WordPress is vulnerable to Stored Cross-Si… |
CVE-2024-11757 | Medium | 6.4 | 2024-12-12 | The WP GeoNames plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-geonames' shortcode in all versions up to, and including… |
CVE-2024-11359 | Medium | 6.1 | 2024-12-12 | The Library Bookshelves plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th… |
CVE-2024-11052 | High | 7.2 | 2024-12-12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter… |
CVE-2024-10637 | Medium | 5.4 | 2024-12-12 | The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back i… |
CVE-2024-10568 | Medium | 4.7 | 2024-12-12 | The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2024-10518 | Medium | 4.8 | 2024-12-12 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise a… |
CVE-2024-10517 | Medium | 4.8 | 2024-12-12 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise a… |
CVE-2024-10499 | High | 7.2 | 2024-12-12 | The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allo… |
CVE-2024-10124 | Critical | 9.8 | 2024-12-12 | The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation… |
CVE-2024-10010 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-12526 | Medium | 4.3 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1… |
CVE-2024-12463 | Medium | 6.4 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arena_embed_amp' shortcod… |
CVE-2024-12441 | Medium | 6.1 | 2024-12-12 | The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and includin… |
CVE-2024-12406 | Medium | 6.5 | 2024-12-12 | The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in… |
CVE-2024-12162 | Medium | 6.1 | 2024-12-12 | The Video & Photo Gallery for Ultimate Member plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up… |
CVE-2024-12156 | Medium | 6.1 | 2024-12-12 | The AI Content Writer, RSS Feed to Post, Autoblogging SEO Help plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in… |
CVE-2024-11891 | Medium | 6.4 | 2024-12-12 | The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to… |
CVE-2024-11875 | Medium | 6.4 | 2024-12-12 | The Add infos to the events calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fuss' shortcode in all versions up to… |
CVE-2024-11804 | Medium | 6.1 | 2024-12-12 | The Planaday API plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 11.4 due to… |
CVE-2024-11750 | Medium | 6.4 | 2024-12-12 | The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up t… |
CVE-2024-11723 | Medium | 6.1 | 2024-12-12 | The kvCORE IDX plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter on pages with the kvcoreidx_listings_sitemap_ranges, kvco… |
CVE-2024-11709 | Medium | 4.3 | 2024-12-12 | The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ai_post_gen… |
CVE-2024-11459 | Medium | 6.1 | 2024-12-12 | The Country Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter in all versions up to, and including, 3.2 due t… |
CVE-2024-11410 | Medium | 6.4 | 2024-12-12 | The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2024-11384 | Medium | 6.4 | 2024-12-12 | The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'arenablog' shortcode in a… |
CVE-2024-10910 | High | 7.3 | 2024-12-12 | The The Grid Plus – Unlimited grid layout plugin for WordPress is vulnerable to arbitrary shortcode execution via grid_plus_load_by_category AJAX action in all… |
CVE-2024-10590 | High | 8.8 | 2024-12-12 | The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all ver… |
CVE-2024-10182 | Medium | 6.4 | 2024-12-12 | The Cognito Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 2.0.7 due to i… |
CVE-2024-12461 | Medium | 6.4 | 2024-12-12 | The WP-Revive Adserver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprevive_async' shortcode in all versions up to, and… |
CVE-2024-12341 | Medium | 4.3 | 2024-12-12 | The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7cs_action_… |
CVE-2024-12338 | Medium | 6.1 | 2024-12-12 | The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolbox_username’ parameter in all versions… |
CVE-2024-12260 | Medium | 6.1 | 2024-12-12 | The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and i… |
CVE-2024-12258 | Medium | 6.1 | 2024-12-12 | The WP Service Payment Form With Authorize.net plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up… |
CVE-2024-11914 | Medium | 6.4 | 2024-12-12 | The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attire-blocks/post-carousel' b… |
CVE-2024-11901 | Medium | 6.4 | 2024-12-12 | The PowerBI Embed Reports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'MO_API_POWER_BI' shortcode in all versions up to… |
CVE-2024-11689 | High | 8.8 | 2024-12-12 | The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or… |
CVE-2024-11683 | Medium | 6.1 | 2024-12-12 | The Newsletter Subscriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_type' parameter in all versions up to, and inc… |
CVE-2024-11443 | High | 8.8 | 2024-12-12 | The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check… |
CVE-2024-11442 | Medium | 6.4 | 2024-12-12 | The Horizontal scroll image slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'horizontal-scroll-image-slideshow' sh… |
CVE-2024-11433 | Medium | 6.4 | 2024-12-12 | The Surbma | SalesAutopilot Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sa-form' shortcode in all versions up… |
CVE-2024-11430 | Medium | 6.5 | 2024-12-12 | The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the 'arg1' arg of the 'gvn_schart_2' shortcode in all versions up to, and includi… |
CVE-2024-11427 | Medium | 6.4 | 2024-12-12 | The Catch Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catch-popup' shortcode in all versions up to, and including… |
CVE-2024-11419 | Medium | 6.1 | 2024-12-12 | The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incor… |
CVE-2024-11417 | Medium | 6.1 | 2024-12-12 | The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due t… |
CVE-2024-11413 | Medium | 6.4 | 2024-12-12 | The HostFact bestelformulier integratie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bestelformulier' shortcode in all v… |
CVE-2024-11279 | Medium | 6.1 | 2024-12-12 | The Schema App Structured Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escapin… |
CVE-2024-11015 | Critical | 9.8 | 2024-12-12 | The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authentica… |
CVE-2024-10111 | High | 8.1 | 2024-12-12 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is… |
CVE-2024-55660 | Critical | 9.8 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template… |
CVE-2024-55659 | Medium | 5.4 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file writ… |
CVE-2024-55658 | High | 7.5 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read vi… |
CVE-2024-55657 | High | 7.5 | 2024-12-12 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpo… |
CVE-2024-55652 | Medium | 6.5 | 2024-12-12 | PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx templat… |
CVE-2024-54534 | Critical | 9.8 | 2024-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18… |
CVE-2024-54531 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2. An app may be able to bypass kASLR. |
CVE-2024-54529 | High | 7.8 | 2024-12-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to e… |
CVE-2024-54528 | High | 7.1 | 2024-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be abl… |
CVE-2024-54527 | Medium | 5.5 | 2024-12-12 | This issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2… |
CVE-2024-54526 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, t… |
CVE-2024-54524 | Medium | 5.5 | 2024-12-12 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to access arbitrary files. |
CVE-2024-54515 | High | 7.8 | 2024-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root privileges. |
CVE-2024-54514 | High | 8.6 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, t… |
CVE-2024-54513 | Medium | 5.5 | 2024-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, w… |
CVE-2024-54510 | Medium | 5.1 | 2024-12-12 | A race condition was addressed with improved locking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2… |
CVE-2024-54508 | High | 7.5 | 2024-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18… |
CVE-2024-54506 | Critical | 9.8 | 2024-12-12 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.2. An attacker may be able to cause unexpect… |
CVE-2024-54505 | High | 8.8 | 2024-12-12 | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia… |
CVE-2024-54504 | Medium | 5.5 | 2024-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2. An app may be able to access use… |
CVE-2024-54503 | Medium | 4.2 | 2024-12-12 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2. Muting a call while ringing… |
CVE-2024-54502 | Medium | 6.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visio… |
CVE-2024-54501 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ve… |
CVE-2024-54500 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ve… |
CVE-2024-54498 | High | 8.8 | 2024-12-12 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may… |
CVE-2024-54495 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to modify protected… |
CVE-2024-54494 | Medium | 5.9 | 2024-12-12 | A race condition was addressed with additional validation. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14… |
CVE-2024-54493 | Low | 3.3 | 2024-12-12 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.2. Privacy indicators for microphone access may be attribut… |
CVE-2024-54492 | Medium | 5.9 | 2024-12-12 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoi… |