# Vulnerabilities published in 2021


- [CVE-2021-24668](https://insights.sbomify.com/CVE-2021-24668/): MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF (medium 4.3)
- [CVE-2021-24667](https://insights.sbomify.com/CVE-2021-24667/): Gallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24666](https://insights.sbomify.com/CVE-2021-24666/): Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24665](https://insights.sbomify.com/CVE-2021-24665/): WP Video Lightbox < 1.9.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24664](https://insights.sbomify.com/CVE-2021-24664/): WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24663](https://insights.sbomify.com/CVE-2021-24663/): Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2021-24662](https://insights.sbomify.com/CVE-2021-24662/): Game Server Status <= 1.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24661](https://insights.sbomify.com/CVE-2021-24661/): PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure (medium 4.3)
- [CVE-2021-24660](https://insights.sbomify.com/CVE-2021-24660/): PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24659](https://insights.sbomify.com/CVE-2021-24659/): PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24658](https://insights.sbomify.com/CVE-2021-24658/): Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24657](https://insights.sbomify.com/CVE-2021-24657/): Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24656](https://insights.sbomify.com/CVE-2021-24656/): Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24655](https://insights.sbomify.com/CVE-2021-24655/): WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise (high 7.5)
- [CVE-2021-24654](https://insights.sbomify.com/CVE-2021-24654/): User Registration < 2.0.2 - Low Privilege Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24653](https://insights.sbomify.com/CVE-2021-24653/): Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24652](https://insights.sbomify.com/CVE-2021-24652/): PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls (medium 6.5)
- [CVE-2021-24651](https://insights.sbomify.com/CVE-2021-24651/): Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection (high 7.5)
- [CVE-2021-24649](https://insights.sbomify.com/CVE-2021-24649/): WP User Frontend < 3.5.29 - Obscure Registration as Admin (critical 9.8)
- [CVE-2021-24648](https://insights.sbomify.com/CVE-2021-24648/): Registration Magic < 5.0.1.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24647](https://insights.sbomify.com/CVE-2021-24647/): Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login (high 8.1)
- [CVE-2021-24646](https://insights.sbomify.com/CVE-2021-24646/): Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24645](https://insights.sbomify.com/CVE-2021-24645/): Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24644](https://insights.sbomify.com/CVE-2021-24644/): Images to WebP < 1.9 - Authenticated Local File Inclusion (high 7.5)
- [CVE-2021-24643](https://insights.sbomify.com/CVE-2021-24643/): WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24642](https://insights.sbomify.com/CVE-2021-24642/): Scroll Baner <= 1.0 - CSRF to RCE (medium 6.5)
- [CVE-2021-24641](https://insights.sbomify.com/CVE-2021-24641/): Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF) (high 8.1)
- [CVE-2021-24640](https://insights.sbomify.com/CVE-2021-24640/): Gutenslider < 5.2.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-2464](https://insights.sbomify.com/CVE-2021-2464/): Other in Oracle Linux (high 7.8)
- [CVE-2021-24639](https://insights.sbomify.com/CVE-2021-24639/): OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion (high 8.1)
- [CVE-2021-24638](https://insights.sbomify.com/CVE-2021-24638/): OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API (critical 9.1)
- [CVE-2021-24637](https://insights.sbomify.com/CVE-2021-24637/): Fonts Plugin < 3.0.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24636](https://insights.sbomify.com/CVE-2021-24636/): Print My Blog < 3.4.2 - Plugin Deactivation via CSRF (high 8.1)
- [CVE-2021-24635](https://insights.sbomify.com/CVE-2021-24635/): Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls (medium 5.4)
- [CVE-2021-24634](https://insights.sbomify.com/CVE-2021-24634/): Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24633](https://insights.sbomify.com/CVE-2021-24633/): Countdown Block < 1.1.2 - Missing Authorisation in AJAX action (medium 4.3)
- [CVE-2021-24632](https://insights.sbomify.com/CVE-2021-24632/): Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24631](https://insights.sbomify.com/CVE-2021-24631/): Unlimited PopUps <= 4.5.3 - Author+ SQL Injection (high 8.8)
- [CVE-2021-24630](https://insights.sbomify.com/CVE-2021-24630/): Schreikasten <= 0.14.18 - Author+ SQL Injections (high 8.8)
- [CVE-2021-2463](https://insights.sbomify.com/CVE-2021-2463/): Other in Commerce Platform (critical 9.8)
- [CVE-2021-24629](https://insights.sbomify.com/CVE-2021-24629/): Post Content XMLRPC <= 1.0 - Admin+ SQL Injections (high 7.2)
- [CVE-2021-24628](https://insights.sbomify.com/CVE-2021-24628/): Wow Forms <= 3.1.3 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24627](https://insights.sbomify.com/CVE-2021-24627/): G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24626](https://insights.sbomify.com/CVE-2021-24626/): Chameleon CSS <= 1.2 - Subscriber+ SQL Injection (high 8.8)
- [CVE-2021-24625](https://insights.sbomify.com/CVE-2021-24625/): SpiderCatalog <= 1.7.3 - Admin+ SQL Injection (high 7.2)
- [CVE-2021-24624](https://insights.sbomify.com/CVE-2021-24624/): MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site Scripting (medium 4.8)
- [CVE-2021-24623](https://insights.sbomify.com/CVE-2021-24623/): WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24622](https://insights.sbomify.com/CVE-2021-24622/): WP Ticket < 5.10.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24621](https://insights.sbomify.com/CVE-2021-24621/): WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code (medium 4.8)
- [CVE-2021-24620](https://insights.sbomify.com/CVE-2021-24620/): Simple eCommerce <= 2.2.5 - Arbitrary File Upload (high 8.8)
- [CVE-2021-2462](https://insights.sbomify.com/CVE-2021-2462/): Cross-site scripting in Commerce Service Center (medium 6.1)
- [CVE-2021-24619](https://insights.sbomify.com/CVE-2021-24619/): Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24618](https://insights.sbomify.com/CVE-2021-24618/): Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24617](https://insights.sbomify.com/CVE-2021-24617/): GamePress <= 1.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24616](https://insights.sbomify.com/CVE-2021-24616/): AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24615](https://insights.sbomify.com/CVE-2021-24615/): Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24614](https://insights.sbomify.com/CVE-2021-24614/): Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24613](https://insights.sbomify.com/CVE-2021-24613/): Post Views Counter < 1.3.5 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24612](https://insights.sbomify.com/CVE-2021-24612/): Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24611](https://insights.sbomify.com/CVE-2021-24611/): Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24610](https://insights.sbomify.com/CVE-2021-24610/): TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2461](https://insights.sbomify.com/CVE-2021-2461/): Other in Communications Interactive Session Recorder (high 8.3)
- [CVE-2021-24609](https://insights.sbomify.com/CVE-2021-24609/): WP Mapa Politico Espana < 3.7.0- Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24608](https://insights.sbomify.com/CVE-2021-24608/): Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24607](https://insights.sbomify.com/CVE-2021-24607/): Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24606](https://insights.sbomify.com/CVE-2021-24606/): Availability Calendar < 1.2.1 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24605](https://insights.sbomify.com/CVE-2021-24605/): Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2021-24604](https://insights.sbomify.com/CVE-2021-24604/): Availability Calendar < 1.2.2 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24603](https://insights.sbomify.com/CVE-2021-24603/): Site Reviews < 5.13.1 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24602](https://insights.sbomify.com/CVE-2021-24602/): HM Multiple Roles < 1.3 - Arbitrary Role Change (high 8.8)
- [CVE-2021-24601](https://insights.sbomify.com/CVE-2021-24601/): WPFront Notification Bar < 2.1.0.08087 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24600](https://insights.sbomify.com/CVE-2021-24600/): WP Dialog <= 1.2.5.5 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-2460](https://insights.sbomify.com/CVE-2021-2460/): Other in Application Express (APEX) (medium 5.4)
- [CVE-2021-24599](https://insights.sbomify.com/CVE-2021-24599/): Email Encoder < 2.1.2 - Reflected Cross Site Scripting (medium 6.1)
- [CVE-2021-24598](https://insights.sbomify.com/CVE-2021-24598/): Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24597](https://insights.sbomify.com/CVE-2021-24597/): You Shang <= 1.0.1 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24596](https://insights.sbomify.com/CVE-2021-24596/): youForms for WordPress <= 1.0.5 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24595](https://insights.sbomify.com/CVE-2021-24595/): WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting (medium 6.5)
- [CVE-2021-24594](https://insights.sbomify.com/CVE-2021-24594/): Translate WordPress - Google Language Translator < 6.0.12 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24593](https://insights.sbomify.com/CVE-2021-24593/): Business Hours Indicator < 2.3.5 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24592](https://insights.sbomify.com/CVE-2021-24592/): Sitewide Notice WP < 2.3 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24591](https://insights.sbomify.com/CVE-2021-24591/): Highlight < 0.9.3 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24590](https://insights.sbomify.com/CVE-2021-24590/): Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.2 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24588](https://insights.sbomify.com/CVE-2021-24588/): SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting (medium 6.1)
- [CVE-2021-24587](https://insights.sbomify.com/CVE-2021-24587/): Splash Header < 1.20.8 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24586](https://insights.sbomify.com/CVE-2021-24586/): Per Page Add to Head < 1.4.4 - CSRF to Stored XSS (medium 4.3)
- [CVE-2021-24585](https://insights.sbomify.com/CVE-2021-24585/): Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure (medium 6.5)
- [CVE-2021-24584](https://insights.sbomify.com/CVE-2021-24584/): Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Update (medium 5.4)
- [CVE-2021-24583](https://insights.sbomify.com/CVE-2021-24583/): Timetable and Event Schedule by MotoPress < 2.4.2 - Unauthorised Event TimeSlot Deletion (medium 4.3)
- [CVE-2021-24582](https://insights.sbomify.com/CVE-2021-24582/): ThinkTwit < 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24581](https://insights.sbomify.com/CVE-2021-24581/): Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS) (high 8.8)
- [CVE-2021-24580](https://insights.sbomify.com/CVE-2021-24580/): Side Menu Lite < 2.2.6 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-2458](https://insights.sbomify.com/CVE-2021-2458/): Other in Identity Manager (high 7.6)
- [CVE-2021-24579](https://insights.sbomify.com/CVE-2021-24579/): Bold Page Builder < 3.1.6 - PHP Object Injection (high 8.8)
- [CVE-2021-24578](https://insights.sbomify.com/CVE-2021-24578/): SportsPress < 2.7.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-24577](https://insights.sbomify.com/CVE-2021-24577/): Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24576](https://insights.sbomify.com/CVE-2021-24576/): Easy Accordion < 2.0.22 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24575](https://insights.sbomify.com/CVE-2021-24575/): WPSchoolPress < 2.1.10 - Multiple Authenticated SQL Injections (high 8.8)
- [CVE-2021-24574](https://insights.sbomify.com/CVE-2021-24574/): Simple Banner < 2.10.4 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24572](https://insights.sbomify.com/CVE-2021-24572/): Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/211/