# Vulnerabilities published in 2021


- [CVE-2021-24571](https://insights.sbomify.com/CVE-2021-24571/): HD Quiz < 1.8.4 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24570](https://insights.sbomify.com/CVE-2021-24570/): Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting (medium 4.3)
- [CVE-2021-2457](https://insights.sbomify.com/CVE-2021-2457/): Information disclosure in Identity Manager (medium 5.3)
- [CVE-2021-24569](https://insights.sbomify.com/CVE-2021-24569/): Cookie Notice & Compliance for GDPR / CCPA < 2.1.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24568](https://insights.sbomify.com/CVE-2021-24568/): AddToAny < 1.7.46 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24567](https://insights.sbomify.com/CVE-2021-24567/): Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24566](https://insights.sbomify.com/CVE-2021-24566/): WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion (high 8.8)
- [CVE-2021-24565](https://insights.sbomify.com/CVE-2021-24565/): Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS (high 8.8)
- [CVE-2021-24564](https://insights.sbomify.com/CVE-2021-24564/): WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24563](https://insights.sbomify.com/CVE-2021-24563/): Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24562](https://insights.sbomify.com/CVE-2021-24562/): LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR (high 7.5)
- [CVE-2021-24561](https://insights.sbomify.com/CVE-2021-24561/): WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24560](https://insights.sbomify.com/CVE-2021-24560/): Software License Manager < 4.4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-2456](https://insights.sbomify.com/CVE-2021-2456/): Other in Business Intelligence Enterprise Edition (critical 9.8)
- [CVE-2021-24559](https://insights.sbomify.com/CVE-2021-24559/): Qyrr < 0.7 - Authenticated (contributor+) Stored XSS (medium 5.4)
- [CVE-2021-24558](https://insights.sbomify.com/CVE-2021-24558/): Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24557](https://insights.sbomify.com/CVE-2021-24557/): M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-24556](https://insights.sbomify.com/CVE-2021-24556/): Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24555](https://insights.sbomify.com/CVE-2021-24555/): Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection (high 8.8)
- [CVE-2021-24554](https://insights.sbomify.com/CVE-2021-24554/): Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-24553](https://insights.sbomify.com/CVE-2021-24553/): Timeline Calendar <= 1.2 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-24552](https://insights.sbomify.com/CVE-2021-24552/): Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-24551](https://insights.sbomify.com/CVE-2021-24551/): Edit Comments <= 0.3 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24550](https://insights.sbomify.com/CVE-2021-24550/): Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-2455](https://insights.sbomify.com/CVE-2021-2455/): Other in PeopleSoft Enterprise HCM Shared Components (medium 6.5)
- [CVE-2021-24549](https://insights.sbomify.com/CVE-2021-24549/): AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File Access (medium 4.9)
- [CVE-2021-24548](https://insights.sbomify.com/CVE-2021-24548/): Mimetic Books <= 0.2.13 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24547](https://insights.sbomify.com/CVE-2021-24547/): KN Fix Your Title <= 1.0.1 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24546](https://insights.sbomify.com/CVE-2021-24546/): EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution (high 8.8)
- [CVE-2021-24545](https://insights.sbomify.com/CVE-2021-24545/): WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24544](https://insights.sbomify.com/CVE-2021-24544/): Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24543](https://insights.sbomify.com/CVE-2021-24543/): jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-24541](https://insights.sbomify.com/CVE-2021-24541/): Wonder PDF Embed < 1.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24540](https://insights.sbomify.com/CVE-2021-24540/): Wonder Video Embed < 1.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-2454](https://insights.sbomify.com/CVE-2021-2454/): Other in VM VirtualBox (high 7.0)
- [CVE-2021-24539](https://insights.sbomify.com/CVE-2021-24539/): Coming Soon, Under Construction & Maintenance Mode By Dazzler < 1.6.7 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24538](https://insights.sbomify.com/CVE-2021-24538/): Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24537](https://insights.sbomify.com/CVE-2021-24537/): Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution (high 7.2)
- [CVE-2021-24536](https://insights.sbomify.com/CVE-2021-24536/): Custom Login Redirect <= 1.0.0 - CSRF to Stored XSS (medium 6.1)
- [CVE-2021-24535](https://insights.sbomify.com/CVE-2021-24535/): Light Messages <= 1.0 - CSRF to Stored XSS (medium 6.1)
- [CVE-2021-24534](https://insights.sbomify.com/CVE-2021-24534/): PhoneTrack Meu Site Manager <= 0.1 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24533](https://insights.sbomify.com/CVE-2021-24533/): Maintenance < 4.03 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24531](https://insights.sbomify.com/CVE-2021-24531/): Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24530](https://insights.sbomify.com/CVE-2021-24530/): Alojapro Widget <= 1.1.15 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-2453](https://insights.sbomify.com/CVE-2021-2453/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24529](https://insights.sbomify.com/CVE-2021-24529/): Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24528](https://insights.sbomify.com/CVE-2021-24528/): FluentSMTP < 2.0.1 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24527](https://insights.sbomify.com/CVE-2021-24527/): Profile Builder < 3.4.9 - Admin Access via Password Reset (critical 9.8)
- [CVE-2021-24526](https://insights.sbomify.com/CVE-2021-24526/): Form Maker < 1.13.60 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24525](https://insights.sbomify.com/CVE-2021-24525/): Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24524](https://insights.sbomify.com/CVE-2021-24524/): GiveWP < 2.12.0 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24523](https://insights.sbomify.com/CVE-2021-24523/): Daily Prayer Time < 2021.08.10 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24522](https://insights.sbomify.com/CVE-2021-24522/): ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget (medium 6.1)
- [CVE-2021-24521](https://insights.sbomify.com/CVE-2021-24521/): Side Menu Lite < 2.2.1 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24520](https://insights.sbomify.com/CVE-2021-24520/): Stock in & out <= 1.0.4 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-2452](https://insights.sbomify.com/CVE-2021-2452/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24519](https://insights.sbomify.com/CVE-2021-24519/): Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24518](https://insights.sbomify.com/CVE-2021-24518/): WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24517](https://insights.sbomify.com/CVE-2021-24517/): Stop Spammers Security < 2021.18 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24516](https://insights.sbomify.com/CVE-2021-24516/): PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24515](https://insights.sbomify.com/CVE-2021-24515/): Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24514](https://insights.sbomify.com/CVE-2021-24514/): Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24513](https://insights.sbomify.com/CVE-2021-24513/): Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24512](https://insights.sbomify.com/CVE-2021-24512/): Video Posts Webcam Recorder < 3.2.4 - Authenticated Reflected XSS (medium 5.4)
- [CVE-2021-24511](https://insights.sbomify.com/CVE-2021-24511/): Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24510](https://insights.sbomify.com/CVE-2021-24510/): MF Gig Calendar < 1.2 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-2451](https://insights.sbomify.com/CVE-2021-2451/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24509](https://insights.sbomify.com/CVE-2021-24509/): Page View Counts < 2.4.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24508](https://insights.sbomify.com/CVE-2021-24508/): Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2021-24507](https://insights.sbomify.com/CVE-2021-24507/): Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24506](https://insights.sbomify.com/CVE-2021-24506/): Slider Hero < 8.2.7 - Contributor+ SQL Injection (high 8.8)
- [CVE-2021-24505](https://insights.sbomify.com/CVE-2021-24505/): Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24504](https://insights.sbomify.com/CVE-2021-24504/): WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24503](https://insights.sbomify.com/CVE-2021-24503/): Popular Brand SVG Icons - Simple Icons < 2.7.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24502](https://insights.sbomify.com/CVE-2021-24502/): WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24501](https://insights.sbomify.com/CVE-2021-24501/): Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions (high 8.1)
- [CVE-2021-24500](https://insights.sbomify.com/CVE-2021-24500/): Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities (high 8.1)
- [CVE-2021-2450](https://insights.sbomify.com/CVE-2021-2450/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24499](https://insights.sbomify.com/CVE-2021-24499/): Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution (critical 9.8)
- [CVE-2021-24498](https://insights.sbomify.com/CVE-2021-24498/): Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24497](https://insights.sbomify.com/CVE-2021-24497/): Giveaway <= 1.2.2 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24496](https://insights.sbomify.com/CVE-2021-24496/): Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24495](https://insights.sbomify.com/CVE-2021-24495/): Marmoset Viewer < 1.9.3 - Reflected Cross Site Scripting (medium 6.1)
- [CVE-2021-24494](https://insights.sbomify.com/CVE-2021-24494/): WP Offload SES Lite < 1.4.5 - Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24493](https://insights.sbomify.com/CVE-2021-24493/): Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-24492](https://insights.sbomify.com/CVE-2021-24492/): Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2021-24491](https://insights.sbomify.com/CVE-2021-24491/): Fileviewer <= 2.2 - Arbitrary File Upload/Deletion via CSRF (high 8.8)
- [CVE-2021-24490](https://insights.sbomify.com/CVE-2021-24490/): Email Artillery <= 4.1 - Arbitrary File Upload (medium 6.8)
- [CVE-2021-2449](https://insights.sbomify.com/CVE-2021-2449/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24489](https://insights.sbomify.com/CVE-2021-24489/): Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24488](https://insights.sbomify.com/CVE-2021-24488/): Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24487](https://insights.sbomify.com/CVE-2021-24487/): St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-24486](https://insights.sbomify.com/CVE-2021-24486/): Simple Social Media Share Buttons < 3.2.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24485](https://insights.sbomify.com/CVE-2021-24485/): Special Text Boxes < 5.9.110 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24484](https://insights.sbomify.com/CVE-2021-24484/): Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL Injections (high 7.2)
- [CVE-2021-24483](https://insights.sbomify.com/CVE-2021-24483/): Poll Maker < 3.2.1 - Authenticated Blind SQL Injections (high 7.2)
- [CVE-2021-24482](https://insights.sbomify.com/CVE-2021-24482/): Related Posts for WordPress <= 2.0.4 - Authenticated Stored XSS & XFS (medium 4.8)
- [CVE-2021-24481](https://insights.sbomify.com/CVE-2021-24481/): Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24480](https://insights.sbomify.com/CVE-2021-24480/): Event Geek <= 2.5.2 - Stored Cross-site Scripting (XSS) (medium 4.8)
- [CVE-2021-2448](https://insights.sbomify.com/CVE-2021-2448/): Other in Financial Services Crime and Compliance Investigation Hub (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/212/