# Vulnerabilities published in 2021


- [CVE-2021-24855](https://insights.sbomify.com/CVE-2021-24855/): Display Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24854](https://insights.sbomify.com/CVE-2021-24854/): QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24853](https://insights.sbomify.com/CVE-2021-24853/): QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update (medium 4.3)
- [CVE-2021-24852](https://insights.sbomify.com/CVE-2021-24852/): MouseWheel Smooth Scroll < 5.7 - Plugin's Setting Update via CSRF (medium 6.5)
- [CVE-2021-24851](https://insights.sbomify.com/CVE-2021-24851/): Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages Access (medium 4.3)
- [CVE-2021-24850](https://insights.sbomify.com/CVE-2021-24850/): Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-2485](https://insights.sbomify.com/CVE-2021-2485/): Other in Trade Management (high 8.1)
- [CVE-2021-24849](https://insights.sbomify.com/CVE-2021-24849/): WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24848](https://insights.sbomify.com/CVE-2021-24848/): Mediamatic < 2.8.1 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24847](https://insights.sbomify.com/CVE-2021-24847/): SEO Redirection < 8.2 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24846](https://insights.sbomify.com/CVE-2021-24846/): Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24845](https://insights.sbomify.com/CVE-2021-24845/): Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages Access (medium 6.5)
- [CVE-2021-24844](https://insights.sbomify.com/CVE-2021-24844/): Affiliate Manager < 2.8.7 - Admin+ SQL injection (high 7.2)
- [CVE-2021-24843](https://insights.sbomify.com/CVE-2021-24843/): SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF (medium 6.5)
- [CVE-2021-24842](https://insights.sbomify.com/CVE-2021-24842/): Bulk Datetime Change < 1.12 - Missing Authorisation (medium 5.4)
- [CVE-2021-24841](https://insights.sbomify.com/CVE-2021-24841/): Helpful < 4.4.59 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24840](https://insights.sbomify.com/CVE-2021-24840/): Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure (medium 5.3)
- [CVE-2021-2484](https://insights.sbomify.com/CVE-2021-2484/): Other in Operations Intelligence (high 8.1)
- [CVE-2021-24839](https://insights.sbomify.com/CVE-2021-24839/): SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion (high 7.5)
- [CVE-2021-24838](https://insights.sbomify.com/CVE-2021-24838/): AnyComment < 0.3.5 - Open Redirect (medium 6.1)
- [CVE-2021-24837](https://insights.sbomify.com/CVE-2021-24837/): Passster < 3.5.5.8 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24836](https://insights.sbomify.com/CVE-2021-24836/): Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update (medium 4.3)
- [CVE-2021-24835](https://insights.sbomify.com/CVE-2021-24835/): WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24834](https://insights.sbomify.com/CVE-2021-24834/): YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module (medium 5.4)
- [CVE-2021-24833](https://insights.sbomify.com/CVE-2021-24833/): YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module (medium 5.4)
- [CVE-2021-24832](https://insights.sbomify.com/CVE-2021-24832/): WP SEO Redirect 301 < 2.3.2 - Redirect Deletion via CSRF (medium 4.3)
- [CVE-2021-24831](https://insights.sbomify.com/CVE-2021-24831/): Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls (high 7.5)
- [CVE-2021-24830](https://insights.sbomify.com/CVE-2021-24830/): Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2483](https://insights.sbomify.com/CVE-2021-2483/): Other in Content Manager (high 8.1)
- [CVE-2021-24829](https://insights.sbomify.com/CVE-2021-24829/): Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24828](https://insights.sbomify.com/CVE-2021-24828/): Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24827](https://insights.sbomify.com/CVE-2021-24827/): Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24826](https://insights.sbomify.com/CVE-2021-24826/): Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24825](https://insights.sbomify.com/CVE-2021-24825/): Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI (medium 4.3)
- [CVE-2021-24824](https://insights.sbomify.com/CVE-2021-24824/): Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access (medium 4.3)
- [CVE-2021-24823](https://insights.sbomify.com/CVE-2021-24823/): Support Board < 3.3.6 - Arbitrary File Deletion via CSRF (high 8.1)
- [CVE-2021-24822](https://insights.sbomify.com/CVE-2021-24822/): Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS (medium 5.4)
- [CVE-2021-24821](https://insights.sbomify.com/CVE-2021-24821/): Cost Calculator < 1.6 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24820](https://insights.sbomify.com/CVE-2021-24820/): Cost Calculator <= 1.6 - Authenticated Local File Inclusion (medium 6.5)
- [CVE-2021-2482](https://insights.sbomify.com/CVE-2021-2482/): Other in Payables (high 8.1)
- [CVE-2021-24819](https://insights.sbomify.com/CVE-2021-24819/): Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access (medium 4.3)
- [CVE-2021-24818](https://insights.sbomify.com/CVE-2021-24818/): WP Limits <= 1.0 - Plugin's Settings Update via CSRF (medium 4.3)
- [CVE-2021-24817](https://insights.sbomify.com/CVE-2021-24817/): Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24816](https://insights.sbomify.com/CVE-2021-24816/): Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming (medium 4.3)
- [CVE-2021-24815](https://insights.sbomify.com/CVE-2021-24815/): Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24814](https://insights.sbomify.com/CVE-2021-24814/): WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting (critical 9.6)
- [CVE-2021-24813](https://insights.sbomify.com/CVE-2021-24813/): Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24812](https://insights.sbomify.com/CVE-2021-24812/): BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24811](https://insights.sbomify.com/CVE-2021-24811/): Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24810](https://insights.sbomify.com/CVE-2021-24810/): WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2481](https://insights.sbomify.com/CVE-2021-2481/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2021-24809](https://insights.sbomify.com/CVE-2021-24809/): BP Better Messages < 1.9.9.41 - Multiple CSRF (high 8.8)
- [CVE-2021-24808](https://insights.sbomify.com/CVE-2021-24808/): BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24807](https://insights.sbomify.com/CVE-2021-24807/): Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24806](https://insights.sbomify.com/CVE-2021-24806/): wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF (medium 4.3)
- [CVE-2021-24805](https://insights.sbomify.com/CVE-2021-24805/): DW Question & Answer Pro <= 1.3.4 - Multiple CSRF (medium 4.3)
- [CVE-2021-24804](https://insights.sbomify.com/CVE-2021-24804/): Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF (high 8.8)
- [CVE-2021-24803](https://insights.sbomify.com/CVE-2021-24803/): Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF (high 8.8)
- [CVE-2021-24802](https://insights.sbomify.com/CVE-2021-24802/): Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF (medium 6.5)
- [CVE-2021-24801](https://insights.sbomify.com/CVE-2021-24801/): WP Survey Plus <= 1.0 - Subscriber+ AJAX Calls (medium 4.3)
- [CVE-2021-24800](https://insights.sbomify.com/CVE-2021-24800/): DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR (medium 4.3)
- [CVE-2021-2480](https://insights.sbomify.com/CVE-2021-2480/): Other in HTTP Server (low 3.7)
- [CVE-2021-24799](https://insights.sbomify.com/CVE-2021-24799/): Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF (medium 4.3)
- [CVE-2021-24798](https://insights.sbomify.com/CVE-2021-24798/): WP Header Images < 2.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24797](https://insights.sbomify.com/CVE-2021-24797/): Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24796](https://insights.sbomify.com/CVE-2021-24796/): My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24795](https://insights.sbomify.com/CVE-2021-24795/): Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF (medium 6.5)
- [CVE-2021-24794](https://insights.sbomify.com/CVE-2021-24794/): Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24793](https://insights.sbomify.com/CVE-2021-24793/): WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24792](https://insights.sbomify.com/CVE-2021-24792/): Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24791](https://insights.sbomify.com/CVE-2021-24791/): Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections (high 7.2)
- [CVE-2021-24790](https://insights.sbomify.com/CVE-2021-24790/): Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls (medium 4.3)
- [CVE-2021-2479](https://insights.sbomify.com/CVE-2021-2479/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24789](https://insights.sbomify.com/CVE-2021-24789/): Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24788](https://insights.sbomify.com/CVE-2021-24788/): Batch Cat <= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to Posts (medium 6.5)
- [CVE-2021-24787](https://insights.sbomify.com/CVE-2021-24787/): Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24786](https://insights.sbomify.com/CVE-2021-24786/): Download Monitor < 4.4.5 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24785](https://insights.sbomify.com/CVE-2021-24785/): Great Quotes <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24784](https://insights.sbomify.com/CVE-2021-24784/): WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF (medium 6.5)
- [CVE-2021-24783](https://insights.sbomify.com/CVE-2021-24783/): Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion (medium 6.5)
- [CVE-2021-24782](https://insights.sbomify.com/CVE-2021-24782/): Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting (medium 4.8)
- [CVE-2021-24781](https://insights.sbomify.com/CVE-2021-24781/): Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value Change (medium 4.3)
- [CVE-2021-24780](https://insights.sbomify.com/CVE-2021-24780/): Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF (medium 4.3)
- [CVE-2021-2478](https://insights.sbomify.com/CVE-2021-2478/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24779](https://insights.sbomify.com/CVE-2021-24779/): WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings Update (medium 6.5)
- [CVE-2021-24778](https://insights.sbomify.com/CVE-2021-24778/): Tradetracker-Store < 4.6.60 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24777](https://insights.sbomify.com/CVE-2021-24777/): Hotscot Contact Form < 1.3 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24776](https://insights.sbomify.com/CVE-2021-24776/): WP Performance Score Booster < 2.1 - Settings Change via CSRF (medium 4.3)
- [CVE-2021-24775](https://insights.sbomify.com/CVE-2021-24775/): Document Embedder < 1.7.5 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure (medium 5.3)
- [CVE-2021-24774](https://insights.sbomify.com/CVE-2021-24774/): Check & Log Email < 1.0.3 - Admin+ SQL Injections (high 7.2)
- [CVE-2021-24773](https://insights.sbomify.com/CVE-2021-24773/): WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24772](https://insights.sbomify.com/CVE-2021-24772/): Stream < 3.8.2 - Admin+ SQL Injection (high 8.8)
- [CVE-2021-24771](https://insights.sbomify.com/CVE-2021-24771/): Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24770](https://insights.sbomify.com/CVE-2021-24770/): Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload (medium 6.5)
- [CVE-2021-2477](https://insights.sbomify.com/CVE-2021-2477/): Denial of service in Applications Framework (medium 5.3)
- [CVE-2021-24769](https://insights.sbomify.com/CVE-2021-24769/): Permalink Manager Lite < 2.2.13.1 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24768](https://insights.sbomify.com/CVE-2021-24768/): WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24767](https://insights.sbomify.com/CVE-2021-24767/): Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF (medium 6.5)
- [CVE-2021-24766](https://insights.sbomify.com/CVE-2021-24766/): 404 to 301 < 3.0.9 - Logs Deletion via CSRF (medium 6.5)
- [CVE-2021-24765](https://insights.sbomify.com/CVE-2021-24765/): Perfect Survey < 1.5.2 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/209/