# Vulnerabilities published in 2021


- [CVE-2021-24958](https://insights.sbomify.com/CVE-2021-24958/): Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-24957](https://insights.sbomify.com/CVE-2021-24957/): Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection (high 8.8)
- [CVE-2021-24956](https://insights.sbomify.com/CVE-2021-24956/): Blog2Social < 6.8.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24955](https://insights.sbomify.com/CVE-2021-24955/): ProfilePress < 3.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24954](https://insights.sbomify.com/CVE-2021-24954/): ProfilePress < 3.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24953](https://insights.sbomify.com/CVE-2021-24953/): Advanced iFrame < 2022 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24952](https://insights.sbomify.com/CVE-2021-24952/): Conversios.io < 4.6.2 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24951](https://insights.sbomify.com/CVE-2021-24951/): LearnPress < 4.1.4 - Admin+ SQL Injection (critical 9.8)
- [CVE-2021-24950](https://insights.sbomify.com/CVE-2021-24950/): Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS (medium 5.4)
- [CVE-2021-24949](https://insights.sbomify.com/CVE-2021-24949/): The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24948](https://insights.sbomify.com/CVE-2021-24948/): The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure (high 7.5)
- [CVE-2021-24947](https://insights.sbomify.com/CVE-2021-24947/): RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read (medium 6.5)
- [CVE-2021-24946](https://insights.sbomify.com/CVE-2021-24946/): Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2021-24945](https://insights.sbomify.com/CVE-2021-24945/): Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure (high 8.0)
- [CVE-2021-24944](https://insights.sbomify.com/CVE-2021-24944/): Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24943](https://insights.sbomify.com/CVE-2021-24943/): Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24942](https://insights.sbomify.com/CVE-2021-24942/): Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution (high 7.2)
- [CVE-2021-24941](https://insights.sbomify.com/CVE-2021-24941/): Icegram < 2.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24940](https://insights.sbomify.com/CVE-2021-24940/): Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24939](https://insights.sbomify.com/CVE-2021-24939/): LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24938](https://insights.sbomify.com/CVE-2021-24938/): WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24937](https://insights.sbomify.com/CVE-2021-24937/): Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24936](https://insights.sbomify.com/CVE-2021-24936/): WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting (high 8.0)
- [CVE-2021-24935](https://insights.sbomify.com/CVE-2021-24935/): WP Google Fonts < 3.1.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24934](https://insights.sbomify.com/CVE-2021-24934/): Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24933](https://insights.sbomify.com/CVE-2021-24933/): Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2021-24932](https://insights.sbomify.com/CVE-2021-24932/): Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24931](https://insights.sbomify.com/CVE-2021-24931/): Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24930](https://insights.sbomify.com/CVE-2021-24930/): Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24928](https://insights.sbomify.com/CVE-2021-24928/): Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection (medium 6.5)
- [CVE-2021-24927](https://insights.sbomify.com/CVE-2021-24927/): My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2021-24926](https://insights.sbomify.com/CVE-2021-24926/): Domain Check < 1.0.17 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24925](https://insights.sbomify.com/CVE-2021-24925/): Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24924](https://insights.sbomify.com/CVE-2021-24924/): Email Log < 2.4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24923](https://insights.sbomify.com/CVE-2021-24923/): Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS (medium 6.1)
- [CVE-2021-24922](https://insights.sbomify.com/CVE-2021-24922/): Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting (critical 9.0)
- [CVE-2021-24921](https://insights.sbomify.com/CVE-2021-24921/): Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24920](https://insights.sbomify.com/CVE-2021-24920/): StatCounter < 2.0.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24919](https://insights.sbomify.com/CVE-2021-24919/): Wicked Folders < 2.18.10 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24918](https://insights.sbomify.com/CVE-2021-24918/): Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-24917](https://insights.sbomify.com/CVE-2021-24917/): WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header (high 7.5)
- [CVE-2021-24916](https://insights.sbomify.com/CVE-2021-24916/): Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending (high 7.5)
- [CVE-2021-24915](https://insights.sbomify.com/CVE-2021-24915/): Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure (critical 9.8)
- [CVE-2021-24914](https://insights.sbomify.com/CVE-2021-24914/): Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal (high 8.0)
- [CVE-2021-24913](https://insights.sbomify.com/CVE-2021-24913/): Logo Showcase with Slick Slider < 2.0.1 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF (medium 4.3)
- [CVE-2021-24912](https://insights.sbomify.com/CVE-2021-24912/): Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS (medium 5.4)
- [CVE-2021-24911](https://insights.sbomify.com/CVE-2021-24911/): Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24910](https://insights.sbomify.com/CVE-2021-24910/): Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24909](https://insights.sbomify.com/CVE-2021-24909/): ACF Photo Gallery Field < 1.7.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24908](https://insights.sbomify.com/CVE-2021-24908/): Check & Log Email < 1.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24907](https://insights.sbomify.com/CVE-2021-24907/): Everest Forms < 1.8.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24906](https://insights.sbomify.com/CVE-2021-24906/): Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation (high 7.5)
- [CVE-2021-24905](https://insights.sbomify.com/CVE-2021-24905/): Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion (high 8.0)
- [CVE-2021-24904](https://insights.sbomify.com/CVE-2021-24904/): Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24903](https://insights.sbomify.com/CVE-2021-24903/): GRAND FlaGallery <= 6.1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24902](https://insights.sbomify.com/CVE-2021-24902/): Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24901](https://insights.sbomify.com/CVE-2021-24901/): Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24900](https://insights.sbomify.com/CVE-2021-24900/): Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting (medium 4.8)
- [CVE-2021-24899](https://insights.sbomify.com/CVE-2021-24899/): Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24898](https://insights.sbomify.com/CVE-2021-24898/): EditableTable <= 0.1.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24897](https://insights.sbomify.com/CVE-2021-24897/): Add Subtitle <= 1.1.0 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24896](https://insights.sbomify.com/CVE-2021-24896/): Caldera forms < 1.9.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24895](https://insights.sbomify.com/CVE-2021-24895/): Cybersoldier < 1.7.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24894](https://insights.sbomify.com/CVE-2021-24894/): Reviews Plus < 1.2.14 - Subscriber+ Reviews DoS (medium 6.5)
- [CVE-2021-24893](https://insights.sbomify.com/CVE-2021-24893/): Stars Rating < 3.5.1 - Comments Denial of Service (high 7.5)
- [CVE-2021-24892](https://insights.sbomify.com/CVE-2021-24892/): Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR (high 8.8)
- [CVE-2021-24891](https://insights.sbomify.com/CVE-2021-24891/): Elementor < 3.4.8 - DOM Cross-Site-Scripting (medium 6.1)
- [CVE-2021-24890](https://insights.sbomify.com/CVE-2021-24890/): Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload (high 8.8)
- [CVE-2021-24889](https://insights.sbomify.com/CVE-2021-24889/): Ninja Forms < 3.6.4 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24888](https://insights.sbomify.com/CVE-2021-24888/): ImageBoss < 3.0.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24885](https://insights.sbomify.com/CVE-2021-24885/): YOP Poll < 6.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24884](https://insights.sbomify.com/CVE-2021-24884/): Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting (critical 9.6)
- [CVE-2021-24883](https://insights.sbomify.com/CVE-2021-24883/): Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24882](https://insights.sbomify.com/CVE-2021-24882/): Slideshow Gallery < 1.7.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24881](https://insights.sbomify.com/CVE-2021-24881/): Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post Access (high 7.5)
- [CVE-2021-24880](https://insights.sbomify.com/CVE-2021-24880/): SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24879](https://insights.sbomify.com/CVE-2021-24879/): SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting (high 8.8)
- [CVE-2021-24878](https://insights.sbomify.com/CVE-2021-24878/): SupportCandy < 2.2.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24877](https://insights.sbomify.com/CVE-2021-24877/): MainWP Child < 4.1.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24876](https://insights.sbomify.com/CVE-2021-24876/): Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24875](https://insights.sbomify.com/CVE-2021-24875/): eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24874](https://insights.sbomify.com/CVE-2021-24874/): Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24873](https://insights.sbomify.com/CVE-2021-24873/): Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24872](https://insights.sbomify.com/CVE-2021-24872/): Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access (medium 6.5)
- [CVE-2021-24871](https://insights.sbomify.com/CVE-2021-24871/): Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24870](https://insights.sbomify.com/CVE-2021-24870/): WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24869](https://insights.sbomify.com/CVE-2021-24869/): WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24868](https://insights.sbomify.com/CVE-2021-24868/): Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure (medium 4.3)
- [CVE-2021-24867](https://insights.sbomify.com/CVE-2021-24867/): Backdoored Plugins & Themes from AccessPress Themes (critical 9.8)
- [CVE-2021-24866](https://insights.sbomify.com/CVE-2021-24866/): WP Data Access < 5.0.0 - Admin+ SQL Injection (critical 9.8)
- [CVE-2021-24865](https://insights.sbomify.com/CVE-2021-24865/): Advanced Custom Fields: Extended < 0.8.8.7 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24864](https://insights.sbomify.com/CVE-2021-24864/): WP Cloudy < 4.4.9 - Admin+ SQL Injection (high 8.8)
- [CVE-2021-24863](https://insights.sbomify.com/CVE-2021-24863/): StopBadBots < 6.67 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24862](https://insights.sbomify.com/CVE-2021-24862/): RegistrationMagic < 5.0.1.6 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24861](https://insights.sbomify.com/CVE-2021-24861/): Quotes Collection <= 2.5.2 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24860](https://insights.sbomify.com/CVE-2021-24860/): BSK PDF Manager < 3.1.2 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24859](https://insights.sbomify.com/CVE-2021-24859/): User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access (medium 4.3)
- [CVE-2021-24858](https://insights.sbomify.com/CVE-2021-24858/): WP Cookie User Info < 1.0.9 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24857](https://insights.sbomify.com/CVE-2021-24857/): ToTop Link <= 1.7.1 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2021-24856](https://insights.sbomify.com/CVE-2021-24856/): Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/208/