CVE-2024-4606

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.3.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
BdThemesUltimate Store Kit Elementor Addons<= 2.0.3
bdthemesutlimate_store_kit_elementor_addons<= 1.6.2

References

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-460607.8Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directCVE-2024-460627.8Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home direcCVE-2024-46077.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture KCVE-2024-460736.1A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. The vulnerability is due to improper sanCVE-2024-460769.8RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection ofCVE-2024-460775.4itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-usCVE-2024-460787.5itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduliCVE-2024-460796.1Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.CVE-2024-46085.4The SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster plugin for WordPress is vulnerable to Stored Cross-CVE-2024-460808.0Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.CVE-2024-460815.4Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads in the To-DoCVE-2024-460825.4Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.