# Vulnerabilities published in 2021


- [CVE-2021-24383](https://insights.sbomify.com/CVE-2021-24383/): WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24382](https://insights.sbomify.com/CVE-2021-24382/): Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24381](https://insights.sbomify.com/CVE-2021-24381/): NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-24380](https://insights.sbomify.com/CVE-2021-24380/): Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF (medium 4.3)
- [CVE-2021-2438](https://insights.sbomify.com/CVE-2021-2438/): Denial of service in Database - Enterprise Edition (medium 4.3)
- [CVE-2021-24379](https://insights.sbomify.com/CVE-2021-24379/): Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass (medium 5.3)
- [CVE-2021-24378](https://insights.sbomify.com/CVE-2021-24378/): Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload (medium 4.8)
- [CVE-2021-24377](https://insights.sbomify.com/CVE-2021-24377/): Autoptimize < 2.7.8 - Race Condition leading to RCE (high 8.1)
- [CVE-2021-24376](https://insights.sbomify.com/CVE-2021-24376/): Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings" (critical 9.8)
- [CVE-2021-24375](https://insights.sbomify.com/CVE-2021-24375/): Motor theme < 3.1.0 - Local File Inclusion (critical 9.8)
- [CVE-2021-24374](https://insights.sbomify.com/CVE-2021-24374/): Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak (medium 5.3)
- [CVE-2021-24373](https://insights.sbomify.com/CVE-2021-24373/): WP Hardening < 1.2.2 - Reflected XSS via historyvalue (medium 6.1)
- [CVE-2021-24372](https://insights.sbomify.com/CVE-2021-24372/): WP Hardening < 1.2.2 - Reflected XSS via URI (medium 6.1)
- [CVE-2021-24371](https://insights.sbomify.com/CVE-2021-24371/): RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF (low 2.7)
- [CVE-2021-24370](https://insights.sbomify.com/CVE-2021-24370/): Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE (critical 9.8)
- [CVE-2021-2437](https://insights.sbomify.com/CVE-2021-2437/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24369](https://insights.sbomify.com/CVE-2021-24369/): GetPaid < 2.3.4 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24368](https://insights.sbomify.com/CVE-2021-24368/): Quiz And Survey Master < 7.1.18 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24367](https://insights.sbomify.com/CVE-2021-24367/): WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24366](https://insights.sbomify.com/CVE-2021-24366/): Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in Label (medium 5.4)
- [CVE-2021-24365](https://insights.sbomify.com/CVE-2021-24365/): Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field (medium 5.4)
- [CVE-2021-24364](https://insights.sbomify.com/CVE-2021-24364/): Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24363](https://insights.sbomify.com/CVE-2021-24363/): Photo Gallery < 1.5.75 - File Upload Path Traversal (medium 4.9)
- [CVE-2021-24362](https://insights.sbomify.com/CVE-2021-24362/): Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG (medium 6.1)
- [CVE-2021-24361](https://insights.sbomify.com/CVE-2021-24361/): GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections (critical 9.8)
- [CVE-2021-24360](https://insights.sbomify.com/CVE-2021-24360/): Yes/No Chart < 1.0.12 - Authenticated (contributor+) Blind SQL Injection (medium 6.5)
- [CVE-2021-2436](https://insights.sbomify.com/CVE-2021-2436/): Other in Common Applications (high 8.2)
- [CVE-2021-24359](https://insights.sbomify.com/CVE-2021-24359/): The Plus Addons for Elementor Page Builder < 4.1.11 - Arbitrary Reset Pwd Email Sending (medium 5.3)
- [CVE-2021-24358](https://insights.sbomify.com/CVE-2021-24358/): The Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect (medium 6.1)
- [CVE-2021-24357](https://insights.sbomify.com/CVE-2021-24357/): FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24356](https://insights.sbomify.com/CVE-2021-24356/): Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Arbitrary Plugin Activation (high 8.8)
- [CVE-2021-24355](https://insights.sbomify.com/CVE-2021-24355/): Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Update and Retrieve Wildcard Value (medium 4.3)
- [CVE-2021-24354](https://insights.sbomify.com/CVE-2021-24354/): Simple 301 Redirects by BetterLinks - 2.0.0-2.0.3 - Arbitrary Plugin Installation (high 8.8)
- [CVE-2021-24353](https://insights.sbomify.com/CVE-2021-24353/): Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Import (high 8.8)
- [CVE-2021-24352](https://insights.sbomify.com/CVE-2021-24352/): Simple 301 Redirects by BetterLinks - 2.0.0 – 2.0.3 - Unauthenticated Redirect Export (high 8.8)
- [CVE-2021-24351](https://insights.sbomify.com/CVE-2021-24351/): The Plus Addons for Elementor < 4.1.12 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24350](https://insights.sbomify.com/CVE-2021-24350/): Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-2435](https://insights.sbomify.com/CVE-2021-2435/): Other in Hyperion Analytic Provider Services (high 8.1)
- [CVE-2021-24349](https://insights.sbomify.com/CVE-2021-24349/): Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24348](https://insights.sbomify.com/CVE-2021-24348/): Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection (high 7.2)
- [CVE-2021-24347](https://insights.sbomify.com/CVE-2021-24347/): SP Project & Document Manager <2 4.22 - Authenticated Shell Upload (high 8.8)
- [CVE-2021-24346](https://insights.sbomify.com/CVE-2021-24346/): Stock in & out <= 1.0.4 - Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24345](https://insights.sbomify.com/CVE-2021-24345/): Sendit WP Newsletter <= 2.5.1 - Authenticated (admin+) SQL Injection (medium 6.6)
- [CVE-2021-24344](https://insights.sbomify.com/CVE-2021-24344/): Easy Preloader <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24343](https://insights.sbomify.com/CVE-2021-24343/): iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24342](https://insights.sbomify.com/CVE-2021-24342/): JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24341](https://insights.sbomify.com/CVE-2021-24341/): Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24340](https://insights.sbomify.com/CVE-2021-24340/): WP Statistics < 13.0.8 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2021-2434](https://insights.sbomify.com/CVE-2021-2434/): Other in Web Applications Desktop Integrator (high 8.1)
- [CVE-2021-24339](https://insights.sbomify.com/CVE-2021-24339/): Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24338](https://insights.sbomify.com/CVE-2021-24338/): Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24337](https://insights.sbomify.com/CVE-2021-24337/): Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection (high 8.8)
- [CVE-2021-24336](https://insights.sbomify.com/CVE-2021-24336/): FlightLog <= 3.0.2 - Authenticated (editor+) SQL Injection (high 7.2)
- [CVE-2021-24335](https://insights.sbomify.com/CVE-2021-24335/): Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFS (medium 6.1)
- [CVE-2021-24334](https://insights.sbomify.com/CVE-2021-24334/): Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFS (medium 5.4)
- [CVE-2021-24333](https://insights.sbomify.com/CVE-2021-24333/): Content Copy Protection & Prevent Image Save <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.5)
- [CVE-2021-24332](https://insights.sbomify.com/CVE-2021-24332/): Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24331](https://insights.sbomify.com/CVE-2021-24331/): Smooth Scroll Page Up/Down Buttons < 1.4 - Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24330](https://insights.sbomify.com/CVE-2021-24330/): Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID (medium 4.8)
- [CVE-2021-2433](https://insights.sbomify.com/CVE-2021-2433/): Denial of service in Hyperion Analytic Provider Services (high 7.5)
- [CVE-2021-24329](https://insights.sbomify.com/CVE-2021-24329/): WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24328](https://insights.sbomify.com/CVE-2021-24328/): WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.2)
- [CVE-2021-24327](https://insights.sbomify.com/CVE-2021-24327/): SEO Redirection < 6.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24326](https://insights.sbomify.com/CVE-2021-24326/): All 404 Redirect to Homepage < 1.21 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24325](https://insights.sbomify.com/CVE-2021-24325/): 404 SEO Redirection <= 1.3 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24324](https://insights.sbomify.com/CVE-2021-24324/): 404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.5)
- [CVE-2021-24323](https://insights.sbomify.com/CVE-2021-24323/): Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24322](https://insights.sbomify.com/CVE-2021-24322/): Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24321](https://insights.sbomify.com/CVE-2021-24321/): Bello < 1.6.0 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2021-24320](https://insights.sbomify.com/CVE-2021-24320/): Bello < 1.6.0 - Unauthenticated Reflected XSS & XFS (medium 6.1)
- [CVE-2021-2432](https://insights.sbomify.com/CVE-2021-2432/): Denial of service in Java SE JDK and JRE (low 3.7)
- [CVE-2021-24319](https://insights.sbomify.com/CVE-2021-24319/): Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS (medium 5.4)
- [CVE-2021-24318](https://insights.sbomify.com/CVE-2021-24318/): Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilities (medium 6.5)
- [CVE-2021-24317](https://insights.sbomify.com/CVE-2021-24317/): Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities (medium 6.1)
- [CVE-2021-24316](https://insights.sbomify.com/CVE-2021-24316/): Mediumish <= 1.0.47 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24315](https://insights.sbomify.com/CVE-2021-24315/): Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24314](https://insights.sbomify.com/CVE-2021-24314/): Goto < 2.1 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2021-24313](https://insights.sbomify.com/CVE-2021-24313/): WP Prayer < 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24312](https://insights.sbomify.com/CVE-2021-24312/): WP Super Cache < 1.7.3 - Authenticated Remote Code Execution (high 7.2)
- [CVE-2021-24311](https://insights.sbomify.com/CVE-2021-24311/): External Media < 1.0.34 - Authenticated Arbitrary File Upload (high 8.8)
- [CVE-2021-24310](https://insights.sbomify.com/CVE-2021-24310/): Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title (medium 4.8)
- [CVE-2021-2431](https://insights.sbomify.com/CVE-2021-2431/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24309](https://insights.sbomify.com/CVE-2021-24309/): Weekly Schedule < 3.4.3 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24308](https://insights.sbomify.com/CVE-2021-24308/): LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit Profile (medium 5.4)
- [CVE-2021-24307](https://insights.sbomify.com/CVE-2021-24307/): All in One SEO Pack < 4.1.0.2 - Admin RCE via unserialize (high 8.8)
- [CVE-2021-24306](https://insights.sbomify.com/CVE-2021-24306/): Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24305](https://insights.sbomify.com/CVE-2021-24305/): Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key (medium 6.1)
- [CVE-2021-24304](https://insights.sbomify.com/CVE-2021-24304/): Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS) (medium 6.1)
- [CVE-2021-24303](https://insights.sbomify.com/CVE-2021-24303/): JiangQie Official Website Mini Program < 1.1.1 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24302](https://insights.sbomify.com/CVE-2021-24302/): Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24301](https://insights.sbomify.com/CVE-2021-24301/): Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24300](https://insights.sbomify.com/CVE-2021-24300/): PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-2430](https://insights.sbomify.com/CVE-2021-2430/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24299](https://insights.sbomify.com/CVE-2021-24299/): ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24298](https://insights.sbomify.com/CVE-2021-24298/): Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24297](https://insights.sbomify.com/CVE-2021-24297/): Goto < 2.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24296](https://insights.sbomify.com/CVE-2021-24296/): WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2021-24295](https://insights.sbomify.com/CVE-2021-24295/): Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 (high 7.5)
- [CVE-2021-24294](https://insights.sbomify.com/CVE-2021-24294/): DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24293](https://insights.sbomify.com/CVE-2021-24293/): NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS) (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/214/