# Vulnerabilities published in 2021


- [CVE-2021-24764](https://insights.sbomify.com/CVE-2021-24764/): Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24763](https://insights.sbomify.com/CVE-2021-24763/): Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update (high 8.8)
- [CVE-2021-24762](https://insights.sbomify.com/CVE-2021-24762/): Perfect Survey < 1.5.2 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24761](https://insights.sbomify.com/CVE-2021-24761/): Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF (medium 6.5)
- [CVE-2021-24760](https://insights.sbomify.com/CVE-2021-24760/): Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-2476](https://insights.sbomify.com/CVE-2021-2476/): Information disclosure in Transportation Management (medium 5.3)
- [CVE-2021-24759](https://insights.sbomify.com/CVE-2021-24759/): PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24758](https://insights.sbomify.com/CVE-2021-24758/): Email Log < 2.4.7 - Admin+ SQL Injection (high 8.8)
- [CVE-2021-24757](https://insights.sbomify.com/CVE-2021-24757/): Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload (medium 5.3)
- [CVE-2021-24756](https://insights.sbomify.com/CVE-2021-24756/): WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24755](https://insights.sbomify.com/CVE-2021-24755/): myCred < 2.3 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24754](https://insights.sbomify.com/CVE-2021-24754/): MainWP Child Reports < 2.0.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24753](https://insights.sbomify.com/CVE-2021-24753/): Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24752](https://insights.sbomify.com/CVE-2021-24752/): Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change (medium 5.7)
- [CVE-2021-24751](https://insights.sbomify.com/CVE-2021-24751/): GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24750](https://insights.sbomify.com/CVE-2021-24750/): WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-2475](https://insights.sbomify.com/CVE-2021-2475/): Denial of service in VM VirtualBox (medium 4.4)
- [CVE-2021-24749](https://insights.sbomify.com/CVE-2021-24749/): URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF (medium 4.3)
- [CVE-2021-24748](https://insights.sbomify.com/CVE-2021-24748/): Email Before Download < 6.8 - Admin+ SQL Injection (high 8.8)
- [CVE-2021-24747](https://insights.sbomify.com/CVE-2021-24747/): SEO Booster < 3.8 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24746](https://insights.sbomify.com/CVE-2021-24746/): Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24745](https://insights.sbomify.com/CVE-2021-24745/): About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24744](https://insights.sbomify.com/CVE-2021-24744/): WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24743](https://insights.sbomify.com/CVE-2021-24743/): Podcast Subscribe Buttons < 1.4.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24742](https://insights.sbomify.com/CVE-2021-24742/): Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings Update (medium 6.5)
- [CVE-2021-24741](https://insights.sbomify.com/CVE-2021-24741/): Support Board < 3.3.4 - Multiple Unauthenticated SQL Injections (critical 9.8)
- [CVE-2021-24740](https://insights.sbomify.com/CVE-2021-24740/): Tutor LMS < 1.9.9 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2474](https://insights.sbomify.com/CVE-2021-2474/): Other in Web Analytics (high 8.1)
- [CVE-2021-24739](https://insights.sbomify.com/CVE-2021-24739/): Logo Carousel < 3.4.2 - Unauthorised Private Post Access (high 8.1)
- [CVE-2021-24738](https://insights.sbomify.com/CVE-2021-24738/): Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24737](https://insights.sbomify.com/CVE-2021-24737/): Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24736](https://insights.sbomify.com/CVE-2021-24736/): Shared Files < 1.6.57 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24735](https://insights.sbomify.com/CVE-2021-24735/): Compact WP Audio Player < 1.9.7 - Setting Change via CSRF (medium 6.5)
- [CVE-2021-24734](https://insights.sbomify.com/CVE-2021-24734/): Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24733](https://insights.sbomify.com/CVE-2021-24733/): WP Post Page Clone < 1.2 - Unauthorised Post Access (medium 4.3)
- [CVE-2021-24732](https://insights.sbomify.com/CVE-2021-24732/): Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24731](https://insights.sbomify.com/CVE-2021-24731/): Pie Register < 3.7.1.6 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24730](https://insights.sbomify.com/CVE-2021-24730/): Logo Showcase with Slick Slider < 1.2.5 - Subscriber+ Arbitrary Media Title/Description/Alt Text/URL Update (medium 4.3)
- [CVE-2021-24729](https://insights.sbomify.com/CVE-2021-24729/): Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site Scripting (medium 5.4)
- [CVE-2021-24728](https://insights.sbomify.com/CVE-2021-24728/): Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24727](https://insights.sbomify.com/CVE-2021-24727/): Block and Stop Bad Bots < 6.60 - Authenticated SQL Injections (high 8.8)
- [CVE-2021-24726](https://insights.sbomify.com/CVE-2021-24726/): WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24725](https://insights.sbomify.com/CVE-2021-24725/): Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF (medium 4.3)
- [CVE-2021-24724](https://insights.sbomify.com/CVE-2021-24724/): Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24723](https://insights.sbomify.com/CVE-2021-24723/): WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site Scripting (medium 5.4)
- [CVE-2021-24722](https://insights.sbomify.com/CVE-2021-24722/): Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24721](https://insights.sbomify.com/CVE-2021-24721/): Loco Translate < 2.5.4 - Authenticated PHP Code Injection (medium 6.5)
- [CVE-2021-24720](https://insights.sbomify.com/CVE-2021-24720/): GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24719](https://insights.sbomify.com/CVE-2021-24719/): Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24718](https://insights.sbomify.com/CVE-2021-24718/): ARForms Form Builder < 1.5 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24717](https://insights.sbomify.com/CVE-2021-24717/): AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation (high 8.8)
- [CVE-2021-24716](https://insights.sbomify.com/CVE-2021-24716/): Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site Scripting (medium 5.4)
- [CVE-2021-24715](https://insights.sbomify.com/CVE-2021-24715/): WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24714](https://insights.sbomify.com/CVE-2021-24714/): WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24713](https://insights.sbomify.com/CVE-2021-24713/): Video Lessons Manager - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24712](https://insights.sbomify.com/CVE-2021-24712/): Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24711](https://insights.sbomify.com/CVE-2021-24711/): Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRF (high 8.8)
- [CVE-2021-24710](https://insights.sbomify.com/CVE-2021-24710/): Print-O-Matic < 2.0.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2471](https://insights.sbomify.com/CVE-2021-2471/): Incorrect Authorization in MySQL Connector Java (medium 5.9)
- [CVE-2021-24709](https://insights.sbomify.com/CVE-2021-24709/): Weather Effect < 1.3.6 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24708](https://insights.sbomify.com/CVE-2021-24708/): WP All Export < 1.3.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24707](https://insights.sbomify.com/CVE-2021-24707/): Learning Courses < 5.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24706](https://insights.sbomify.com/CVE-2021-24706/): Qwizcards < 3.62 - Admin+ Stored Cross Site Scripting (medium 4.8)
- [CVE-2021-24705](https://insights.sbomify.com/CVE-2021-24705/): NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF (medium 4.8)
- [CVE-2021-24704](https://insights.sbomify.com/CVE-2021-24704/): Orange Form <= 1.0 - SQL Injection via CSRF (high 8.8)
- [CVE-2021-24703](https://insights.sbomify.com/CVE-2021-24703/): Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation (medium 5.7)
- [CVE-2021-24702](https://insights.sbomify.com/CVE-2021-24702/): LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24701](https://insights.sbomify.com/CVE-2021-24701/): Quiz Tool Lite <= 2.3.15 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24700](https://insights.sbomify.com/CVE-2021-24700/): Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24699](https://insights.sbomify.com/CVE-2021-24699/): Easy Media Download < 1.1.7 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24698](https://insights.sbomify.com/CVE-2021-24698/): Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails Removal (medium 4.3)
- [CVE-2021-24697](https://insights.sbomify.com/CVE-2021-24697/): Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24696](https://insights.sbomify.com/CVE-2021-24696/): Simple Download Monitor < 3.9.9 - Multiple CSRF (high 8.8)
- [CVE-2021-24695](https://insights.sbomify.com/CVE-2021-24695/): Simple Download Monitor < 3.9.6 - Unauthenticated Log Access (high 7.5)
- [CVE-2021-24694](https://insights.sbomify.com/CVE-2021-24694/): Simple Download Monitor < 3.9.11 - Contributor+ Stored Cross-Site Scripting via Shortcodes (medium 5.4)
- [CVE-2021-24693](https://insights.sbomify.com/CVE-2021-24693/): Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail (critical 9.0)
- [CVE-2021-24692](https://insights.sbomify.com/CVE-2021-24692/): Simple Download Monitor < 3.9.5 - Contributor+ Arbitrary File Download via Path Traversal (medium 6.5)
- [CVE-2021-24691](https://insights.sbomify.com/CVE-2021-24691/): Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24690](https://insights.sbomify.com/CVE-2021-24690/): Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting (medium 5.4)
- [CVE-2021-24689](https://insights.sbomify.com/CVE-2021-24689/): Contact Forms - Drag & Drop Contact Form Builder <= 1.0.5 - Admin+ Arbitrary System File Read (medium 4.9)
- [CVE-2021-24688](https://insights.sbomify.com/CVE-2021-24688/): Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion (medium 4.3)
- [CVE-2021-24687](https://insights.sbomify.com/CVE-2021-24687/): Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24686](https://insights.sbomify.com/CVE-2021-24686/): SVG Support < 2.3.20 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24685](https://insights.sbomify.com/CVE-2021-24685/): Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24684](https://insights.sbomify.com/CVE-2021-24684/): PDF Light Viewer < 1.4.12 - Authenticated Command Injection (high 8.8)
- [CVE-2021-24683](https://insights.sbomify.com/CVE-2021-24683/): Weather Effect < 1.3.4 - CSRF to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24682](https://insights.sbomify.com/CVE-2021-24682/): Cool Tag Cloud < 2.26 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24681](https://insights.sbomify.com/CVE-2021-24681/): Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24680](https://insights.sbomify.com/CVE-2021-24680/): WP Travel Engine < 5.3.1 - Editor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24679](https://insights.sbomify.com/CVE-2021-24679/): Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24678](https://insights.sbomify.com/CVE-2021-24678/): CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24677](https://insights.sbomify.com/CVE-2021-24677/): Find My Blocks < 3.4.0 - Private Post Titles Disclosure (medium 5.3)
- [CVE-2021-24676](https://insights.sbomify.com/CVE-2021-24676/): Better Find and Replace < 1.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24675](https://insights.sbomify.com/CVE-2021-24675/): One User Avatar < 2.3.7 - Avatar Update via CSRF (medium 6.5)
- [CVE-2021-24674](https://insights.sbomify.com/CVE-2021-24674/): Genie WP Favicon <= 0.5.2 - Arbitrary Favicon Change via CSRF (medium 6.5)
- [CVE-2021-24673](https://insights.sbomify.com/CVE-2021-24673/): Appointment Hour Booking < 1.3.16 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24672](https://insights.sbomify.com/CVE-2021-24672/): One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24671](https://insights.sbomify.com/CVE-2021-24671/): MX Time Zone Clocks < 3.4.1 - Contributor+ Cross-Site Scripting (medium 5.4)
- [CVE-2021-24670](https://insights.sbomify.com/CVE-2021-24670/): CoolClock < 4.3.5 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24669](https://insights.sbomify.com/CVE-2021-24669/): MAZ Loader < 1.3.3 - Contributor+ SQL Injection (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/210/