# Vulnerabilities published in 2021


- [CVE-2021-25059](https://insights.sbomify.com/CVE-2021-25059/): Download Plugin < 2.0.0 - Subscriber+ Website Download (medium 5.4)
- [CVE-2021-25058](https://insights.sbomify.com/CVE-2021-25058/): The Buffer Button <= 1.0 - Authenticated Stored Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2021-25057](https://insights.sbomify.com/CVE-2021-25057/): Translation Exchange <= 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-25056](https://insights.sbomify.com/CVE-2021-25056/): Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25055](https://insights.sbomify.com/CVE-2021-25055/): FeedWordPress < 2022.0123 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-25054](https://insights.sbomify.com/CVE-2021-25054/): WPcalc <= 2.1 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-25053](https://insights.sbomify.com/CVE-2021-25053/): WP Coder < 2.5.2 - RFI leading to RCE via CSRF (high 8.8)
- [CVE-2021-25052](https://insights.sbomify.com/CVE-2021-25052/): Button Generator < 2.3.3 - RFI leading to RCE via CSRF (high 8.8)
- [CVE-2021-25051](https://insights.sbomify.com/CVE-2021-25051/): Modal Window < 5.2.2 - RFI leading to RCE via CSRF (high 8.8)
- [CVE-2021-25050](https://insights.sbomify.com/CVE-2021-25050/): Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25049](https://insights.sbomify.com/CVE-2021-25049/): Mobile Events Manager < 1.4.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25048](https://insights.sbomify.com/CVE-2021-25048/): KingComposer <= 2.9.6 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-25047](https://insights.sbomify.com/CVE-2021-25047/): 10Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-25046](https://insights.sbomify.com/CVE-2021-25046/): Modern Events Calendar Lite < 6.2.0 - Subscriber+ Category Add Leading to Stored XSS (medium 5.4)
- [CVE-2021-25045](https://insights.sbomify.com/CVE-2021-25045/): Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id (high 7.2)
- [CVE-2021-25044](https://insights.sbomify.com/CVE-2021-25044/): Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25043](https://insights.sbomify.com/CVE-2021-25043/): WOOCS < 1.3.7.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25042](https://insights.sbomify.com/CVE-2021-25042/): WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS (medium 5.4)
- [CVE-2021-25041](https://insights.sbomify.com/CVE-2021-25041/): Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-25040](https://insights.sbomify.com/CVE-2021-25040/): Booking Calendar < 8.9.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25039](https://insights.sbomify.com/CVE-2021-25039/): Multisite Content Copier/Updater < 2.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25038](https://insights.sbomify.com/CVE-2021-25038/): Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25037](https://insights.sbomify.com/CVE-2021-25037/): All In One SEO < 4.1.5.3 - Authenticated SQL Injection (medium 6.5)
- [CVE-2021-25036](https://insights.sbomify.com/CVE-2021-25036/): All In One SEO < 4.1.5.3 - Authenticated Privilege Escalation (high 8.8)
- [CVE-2021-25035](https://insights.sbomify.com/CVE-2021-25035/): Backup and Staging by WP Time Capsule < 1.22.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25034](https://insights.sbomify.com/CVE-2021-25034/): WP User < 7.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25033](https://insights.sbomify.com/CVE-2021-25033/): Noptin < 1.6.5 - Open Redirect (medium 6.1)
- [CVE-2021-25032](https://insights.sbomify.com/CVE-2021-25032/): PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise (critical 9.8)
- [CVE-2021-25031](https://insights.sbomify.com/CVE-2021-25031/): Image Hover Effects Ultimate < 9.7.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25030](https://insights.sbomify.com/CVE-2021-25030/): Events Made Easy < 2.2.36 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-25029](https://insights.sbomify.com/CVE-2021-25029/): Cluevo < 1.8.1 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-25028](https://insights.sbomify.com/CVE-2021-25028/): Event Tickets < 5.2.2 - Open Redirect (medium 6.1)
- [CVE-2021-25027](https://insights.sbomify.com/CVE-2021-25027/): PowerPack Addons for Elementor < 2.6.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25026](https://insights.sbomify.com/CVE-2021-25026/): Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site Scripting (medium 5.5)
- [CVE-2021-25025](https://insights.sbomify.com/CVE-2021-25025/): Event Calendar < 1.1.51 - Subscriber+ Event Creation (medium 4.3)
- [CVE-2021-25024](https://insights.sbomify.com/CVE-2021-25024/): Event Calendar < 1.1.51 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25023](https://insights.sbomify.com/CVE-2021-25023/): Speed Booster Pack < 4.3.3.1 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-25022](https://insights.sbomify.com/CVE-2021-25022/): UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25021](https://insights.sbomify.com/CVE-2021-25021/): OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path Traversal (medium 4.9)
- [CVE-2021-25020](https://insights.sbomify.com/CVE-2021-25020/): CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal (medium 4.9)
- [CVE-2021-25019](https://insights.sbomify.com/CVE-2021-25019/): SEO Plugin by Squirrly SEO < 11.1.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25018](https://insights.sbomify.com/CVE-2021-25018/): PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-25017](https://insights.sbomify.com/CVE-2021-25017/): Tutor LMS < 1.9.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25016](https://insights.sbomify.com/CVE-2021-25016/): Chaty < 2.8.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25015](https://insights.sbomify.com/CVE-2021-25015/): myCred < 2.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25014](https://insights.sbomify.com/CVE-2021-25014/): Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS (low 3.5)
- [CVE-2021-25013](https://insights.sbomify.com/CVE-2021-25013/): Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion (medium 6.5)
- [CVE-2021-25012](https://insights.sbomify.com/CVE-2021-25012/): Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25011](https://insights.sbomify.com/CVE-2021-25011/): WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update (medium 5.7)
- [CVE-2021-25010](https://insights.sbomify.com/CVE-2021-25010/): Post Snippets < 3.1.4 - CSRF to Stored Cross-Site Scripting (critical 9.6)
- [CVE-2021-25009](https://insights.sbomify.com/CVE-2021-25009/): CorreosExpress <= 2.6.0 - Sensitive Information Disclosure (medium 5.3)
- [CVE-2021-25008](https://insights.sbomify.com/CVE-2021-25008/): Code Snippets < 2.14.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25007](https://insights.sbomify.com/CVE-2021-25007/): MOLIE <= 0.5 - Authenticated SQL Injection (critical 9.8)
- [CVE-2021-25006](https://insights.sbomify.com/CVE-2021-25006/): MOLIE <= 0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25005](https://insights.sbomify.com/CVE-2021-25005/): SEUR Oficial < 1.7.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25004](https://insights.sbomify.com/CVE-2021-25004/): SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download (medium 4.9)
- [CVE-2021-25003](https://insights.sbomify.com/CVE-2021-25003/): WPCargo < 6.9.0 - Unauthenticated RCE (critical 9.8)
- [CVE-2021-25002](https://insights.sbomify.com/CVE-2021-25002/): Tipsacarrier < 1.5.0.5 - Unauthenticated Orders Disclosure (high 7.5)
- [CVE-2021-25001](https://insights.sbomify.com/CVE-2021-25001/): Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in Product XML Feeds Module (medium 6.1)
- [CVE-2021-25000](https://insights.sbomify.com/CVE-2021-25000/): Booster for WooCommerce < 5.4.9 - Reflected Cross-Site Scripting in General Module (medium 6.1)
- [CVE-2021-24999](https://insights.sbomify.com/CVE-2021-24999/): Booster for Woocommerce < 5.4.9 - Reflected Cross-Site Scripting in PDF Invoicing Module (medium 6.1)
- [CVE-2021-24998](https://insights.sbomify.com/CVE-2021-24998/): Simple JWT Login < 3.3.0 - Insecure Password Creation (high 7.5)
- [CVE-2021-24997](https://insights.sbomify.com/CVE-2021-24997/): WP Guppy < 1.3 - Sensitive Information Disclosure (medium 6.5)
- [CVE-2021-24996](https://insights.sbomify.com/CVE-2021-24996/): IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24995](https://insights.sbomify.com/CVE-2021-24995/): HTML5 Responsive FAQ <= 2.8.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24994](https://insights.sbomify.com/CVE-2021-24994/): WPvivid Backup and Migration Plugin < 0.9.69 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24993](https://insights.sbomify.com/CVE-2021-24993/): Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update (medium 6.5)
- [CVE-2021-24992](https://insights.sbomify.com/CVE-2021-24992/): Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24991](https://insights.sbomify.com/CVE-2021-24991/): WooCommerce PDF Invoices & Packing Slips < 2.10.5 - Reflected Cross-Site Scripting (medium 4.8)
- [CVE-2021-24989](https://insights.sbomify.com/CVE-2021-24989/): Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF (medium 6.5)
- [CVE-2021-24988](https://insights.sbomify.com/CVE-2021-24988/): WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24987](https://insights.sbomify.com/CVE-2021-24987/): Super Socializer < 7.13.30 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24986](https://insights.sbomify.com/CVE-2021-24986/): Post Grid < 2.1.16 - Reflected Cross-Site Scripting via keyword (medium 6.1)
- [CVE-2021-24985](https://insights.sbomify.com/CVE-2021-24985/): Easy Forms for Mailchimp < 6.8.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24984](https://insights.sbomify.com/CVE-2021-24984/): WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24983](https://insights.sbomify.com/CVE-2021-24983/): Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting via AJAX Action (medium 6.1)
- [CVE-2021-24982](https://insights.sbomify.com/CVE-2021-24982/): Child Theme Generator <= 2.2.7 - Reflected Cross-Site Scripting (medium 6.4)
- [CVE-2021-24981](https://insights.sbomify.com/CVE-2021-24981/): Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload (high 7.5)
- [CVE-2021-24980](https://insights.sbomify.com/CVE-2021-24980/): Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24979](https://insights.sbomify.com/CVE-2021-24979/): Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24978](https://insights.sbomify.com/CVE-2021-24978/): OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion (medium 5.3)
- [CVE-2021-24977](https://insights.sbomify.com/CVE-2021-24977/): Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending (medium 6.1)
- [CVE-2021-24976](https://insights.sbomify.com/CVE-2021-24976/): Smart SEO Tool < 3.0.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24975](https://insights.sbomify.com/CVE-2021-24975/): NextScripts: Social Networks Auto-Poster < 4.3.24 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2021-24974](https://insights.sbomify.com/CVE-2021-24974/): Product Feed PRO for WooCommerce < 11.0.7 - Subscriber+ Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-24973](https://insights.sbomify.com/CVE-2021-24973/): Site Reviews < 5.17.3 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24972](https://insights.sbomify.com/CVE-2021-24972/): Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24971](https://insights.sbomify.com/CVE-2021-24971/): WP Responsive Menu < 3.1.7.1 - Subscriber+ Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-24970](https://insights.sbomify.com/CVE-2021-24970/): All-In-One-Gallery < 2.5.0 - Admin+ Local File Inclusion (high 7.2)
- [CVE-2021-24969](https://insights.sbomify.com/CVE-2021-24969/): Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24968](https://insights.sbomify.com/CVE-2021-24968/): Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation (medium 5.7)
- [CVE-2021-24967](https://insights.sbomify.com/CVE-2021-24967/): Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24966](https://insights.sbomify.com/CVE-2021-24966/): Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing (medium 4.9)
- [CVE-2021-24965](https://insights.sbomify.com/CVE-2021-24965/): Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24964](https://insights.sbomify.com/CVE-2021-24964/): LiteSpeed Cache < 4.4.4 - IP Check Bypass to Unauthenticated Stored XSS (medium 6.1)
- [CVE-2021-24963](https://insights.sbomify.com/CVE-2021-24963/): LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting (medium 4.8)
- [CVE-2021-24962](https://insights.sbomify.com/CVE-2021-24962/): WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE (high 8.8)
- [CVE-2021-24961](https://insights.sbomify.com/CVE-2021-24961/): WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2021-24960](https://insights.sbomify.com/CVE-2021-24960/): WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG (medium 5.4)
- [CVE-2021-24959](https://insights.sbomify.com/CVE-2021-24959/): WP Email Users <= 1.7.6 - Subscriber+ SQL Injection (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/207/