# Vulnerabilities published in 2021


- [CVE-2021-24292](https://insights.sbomify.com/CVE-2021-24292/): Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24291](https://insights.sbomify.com/CVE-2021-24291/): Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24290](https://insights.sbomify.com/CVE-2021-24290/): Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-2429](https://insights.sbomify.com/CVE-2021-2429/): Denial of service in MySQL Server (medium 5.9)
- [CVE-2021-24289](https://insights.sbomify.com/CVE-2021-24289/): Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation (high 8.8)
- [CVE-2021-24288](https://insights.sbomify.com/CVE-2021-24288/): AcyMailing < 7.5.0 - Unauthenticated Open Redirect (medium 6.1)
- [CVE-2021-24287](https://insights.sbomify.com/CVE-2021-24287/): Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24286](https://insights.sbomify.com/CVE-2021-24286/): Redirect 404 to Parent < 1.3.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24285](https://insights.sbomify.com/CVE-2021-24285/): Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24284](https://insights.sbomify.com/CVE-2021-24284/): Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-24283](https://insights.sbomify.com/CVE-2021-24283/): Accordion < 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24282](https://insights.sbomify.com/CVE-2021-24282/): Redirection for Contact Form 7 < 2.3.4 - Unprotected AJAX Actions (medium 6.3)
- [CVE-2021-24281](https://insights.sbomify.com/CVE-2021-24281/): Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Post Deletion (medium 4.3)
- [CVE-2021-24280](https://insights.sbomify.com/CVE-2021-24280/): Redirection for Contact Form 7 < 2.3.4 - Authenticated PHP Object Injection (high 8.8)
- [CVE-2021-2428](https://insights.sbomify.com/CVE-2021-2428/): Other in Coherence (high 8.1)
- [CVE-2021-24279](https://insights.sbomify.com/CVE-2021-24279/): Redirection for Contact Form 7 < 2.3.4 - Authenticated Arbitrary Plugin Installation (medium 6.5)
- [CVE-2021-24278](https://insights.sbomify.com/CVE-2021-24278/): Redirection for Contact Form 7 < 2.3.4 - Unauthenticated Arbitrary Nonce Generation (high 7.5)
- [CVE-2021-24277](https://insights.sbomify.com/CVE-2021-24277/): RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24276](https://insights.sbomify.com/CVE-2021-24276/): Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS) (medium 6.1)
- [CVE-2021-24275](https://insights.sbomify.com/CVE-2021-24275/): Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS) (medium 6.1)
- [CVE-2021-24274](https://insights.sbomify.com/CVE-2021-24274/): Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS) (medium 6.1)
- [CVE-2021-24273](https://insights.sbomify.com/CVE-2021-24273/): Clever Addons for Elementor < 2.1.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24272](https://insights.sbomify.com/CVE-2021-24272/): Fitness Calculators < 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS) (medium 4.3)
- [CVE-2021-24271](https://insights.sbomify.com/CVE-2021-24271/): Ultimate Addons for Elementor < 1.30.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24270](https://insights.sbomify.com/CVE-2021-24270/): DethemeKit For Elementor < 1.5.5.5 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-2427](https://insights.sbomify.com/CVE-2021-2427/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24269](https://insights.sbomify.com/CVE-2021-24269/): Sina Extension for Elementor < 3.3.12 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24268](https://insights.sbomify.com/CVE-2021-24268/): JetWidgets For Elementor < 1.0.9 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24267](https://insights.sbomify.com/CVE-2021-24267/): All-in-One Addons for Elementor - WidgetKit < 2.3.10 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24266](https://insights.sbomify.com/CVE-2021-24266/): The Plus Addons for Elementor Page Builder Lite < 2.0.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24265](https://insights.sbomify.com/CVE-2021-24265/): Rife Elementor Extensions & Templates < 1.1.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24264](https://insights.sbomify.com/CVE-2021-24264/): Image Hover Effects - Elementor Addon < 1.3.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24263](https://insights.sbomify.com/CVE-2021-24263/): PowerPack Addons for Elementor < 2.3.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24262](https://insights.sbomify.com/CVE-2021-24262/): WooLentor - WooCommerce Elementor Addons + Builder < 1.8.6 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24261](https://insights.sbomify.com/CVE-2021-24261/): HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24260](https://insights.sbomify.com/CVE-2021-24260/): Livemesh Addons for Elementor < 6.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-2426](https://insights.sbomify.com/CVE-2021-2426/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24259](https://insights.sbomify.com/CVE-2021-24259/): Elementor Addon Elements < 1.11.2 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24258](https://insights.sbomify.com/CVE-2021-24258/): ElementsKit and ElementsKit Pro < 2.2.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24257](https://insights.sbomify.com/CVE-2021-24257/): Premium Addons for Elementor < 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24256](https://insights.sbomify.com/CVE-2021-24256/): Elementor - Header, Footer & Blocks Template < 1.5.8 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2021-24255](https://insights.sbomify.com/CVE-2021-24255/): Essential Addons for Elementor < 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24254](https://insights.sbomify.com/CVE-2021-24254/): College Publisher Import <= 0.1 - Arbitrary File Upload to RCE (high 7.2)
- [CVE-2021-24253](https://insights.sbomify.com/CVE-2021-24253/): Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE (high 8.8)
- [CVE-2021-24252](https://insights.sbomify.com/CVE-2021-24252/): Event Banner <= 1.3 - Arbitrary File Upload to RCE (high 7.2)
- [CVE-2021-24251](https://insights.sbomify.com/CVE-2021-24251/): Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update (medium 4.3)
- [CVE-2021-24250](https://insights.sbomify.com/CVE-2021-24250/): Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-2425](https://insights.sbomify.com/CVE-2021-2425/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24249](https://insights.sbomify.com/CVE-2021-24249/): Business Directory Plugin < 5.11.2 - Arbitrary Listing Export (medium 6.5)
- [CVE-2021-24248](https://insights.sbomify.com/CVE-2021-24248/): Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE (high 7.2)
- [CVE-2021-24247](https://insights.sbomify.com/CVE-2021-24247/): Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24246](https://insights.sbomify.com/CVE-2021-24246/): WorkScout Core < 1.3.4 - Authenticated Stored XSS & XFS (medium 5.4)
- [CVE-2021-24245](https://insights.sbomify.com/CVE-2021-24245/): Stop Spammers < 2021.9 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24244](https://insights.sbomify.com/CVE-2021-24244/): WPBakery Page Builder Clipboard < 4.5.8 - Unauthorised Arbitrary License Options Update (medium 6.5)
- [CVE-2021-24243](https://insights.sbomify.com/CVE-2021-24243/): WPBakery Page Builder Clipboard < 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24242](https://insights.sbomify.com/CVE-2021-24242/): Tutor LMS < 1.8.8 - Authenticated Local File Inclusion (low 3.8)
- [CVE-2021-24241](https://insights.sbomify.com/CVE-2021-24241/): Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24240](https://insights.sbomify.com/CVE-2021-24240/): Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE (critical 9.8)
- [CVE-2021-2424](https://insights.sbomify.com/CVE-2021-2424/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24239](https://insights.sbomify.com/CVE-2021-24239/): Pie Register < 3.7.0.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24238](https://insights.sbomify.com/CVE-2021-24238/): Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR (medium 6.5)
- [CVE-2021-24237](https://insights.sbomify.com/CVE-2021-24237/): Realteo < 1.2.4 - Unauthenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24236](https://insights.sbomify.com/CVE-2021-24236/): Imagements <= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE (critical 9.8)
- [CVE-2021-24235](https://insights.sbomify.com/CVE-2021-24235/): Goto - Tour & Travel < 2.0 - Unauthenticated Reflected XSS (medium 6.1)
- [CVE-2021-24234](https://insights.sbomify.com/CVE-2021-24234/): Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24233](https://insights.sbomify.com/CVE-2021-24233/): Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24232](https://insights.sbomify.com/CVE-2021-24232/): Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24231](https://insights.sbomify.com/CVE-2021-24231/): Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From Patreon (medium 6.5)
- [CVE-2021-24230](https://insights.sbomify.com/CVE-2021-24230/): Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta (high 8.1)
- [CVE-2021-2423](https://insights.sbomify.com/CVE-2021-2423/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24229](https://insights.sbomify.com/CVE-2021-24229/): Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action (critical 9.6)
- [CVE-2021-24228](https://insights.sbomify.com/CVE-2021-24228/): Patreon WordPress < 1.7.2 - Reflected XSS on Login Form (critical 9.6)
- [CVE-2021-24227](https://insights.sbomify.com/CVE-2021-24227/): Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure (high 7.5)
- [CVE-2021-24226](https://insights.sbomify.com/CVE-2021-24226/): AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage (high 7.5)
- [CVE-2021-24225](https://insights.sbomify.com/CVE-2021-24225/): Advanced Booking Calendar < 1.6.7 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24224](https://insights.sbomify.com/CVE-2021-24224/): Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload (high 8.8)
- [CVE-2021-24223](https://insights.sbomify.com/CVE-2021-24223/): N5 Upload Form <= 1.0 - Unauthenticated Arbitrary File Upload to RCE (critical 9.8)
- [CVE-2021-24222](https://insights.sbomify.com/CVE-2021-24222/): WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE (critical 9.8)
- [CVE-2021-24221](https://insights.sbomify.com/CVE-2021-24221/): Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode (high 8.8)
- [CVE-2021-24220](https://insights.sbomify.com/CVE-2021-24220/): All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion (critical 9.1)
- [CVE-2021-2422](https://insights.sbomify.com/CVE-2021-2422/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24219](https://insights.sbomify.com/CVE-2021-24219/): All Thrive Themes and Plugins - Unauthenticated Option Update (medium 5.3)
- [CVE-2021-24218](https://insights.sbomify.com/CVE-2021-24218/): Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion (high 8.8)
- [CVE-2021-24217](https://insights.sbomify.com/CVE-2021-24217/): Facebook for WordPress < 3.0.0 - PHP Object Injection with POP Chain (high 8.1)
- [CVE-2021-24216](https://insights.sbomify.com/CVE-2021-24216/): All-in-One WP Migration < 7.41 - Admin+ Arbitrary File Upload to RCE (high 7.2)
- [CVE-2021-24215](https://insights.sbomify.com/CVE-2021-24215/): Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation (critical 9.8)
- [CVE-2021-24214](https://insights.sbomify.com/CVE-2021-24214/): OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error (medium 6.1)
- [CVE-2021-24213](https://insights.sbomify.com/CVE-2021-24213/): GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24212](https://insights.sbomify.com/CVE-2021-24212/): WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE (critical 9.8)
- [CVE-2021-24211](https://insights.sbomify.com/CVE-2021-24211/): WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24210](https://insights.sbomify.com/CVE-2021-24210/): PhastPress < 1.111 - Open Redirect (medium 6.1)
- [CVE-2021-2421](https://insights.sbomify.com/CVE-2021-2421/): Other in PeopleSoft Enterprise CS Campus Community (medium 6.5)
- [CVE-2021-24209](https://insights.sbomify.com/CVE-2021-24209/): WP Super Cache < 1.7.2 - Authenticated Remote Code Execution (RCE) (high 7.2)
- [CVE-2021-24208](https://insights.sbomify.com/CVE-2021-24208/): WP Page Builder < 1.2.4 - Multiple Stored Cross-Site scripting (XSS) (medium 5.4)
- [CVE-2021-24207](https://insights.sbomify.com/CVE-2021-24207/): WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts (medium 4.3)
- [CVE-2021-24206](https://insights.sbomify.com/CVE-2021-24206/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget (medium 5.4)
- [CVE-2021-24205](https://insights.sbomify.com/CVE-2021-24205/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget (medium 5.4)
- [CVE-2021-24204](https://insights.sbomify.com/CVE-2021-24204/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget (medium 5.4)
- [CVE-2021-24203](https://insights.sbomify.com/CVE-2021-24203/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget (medium 5.4)
- [CVE-2021-24202](https://insights.sbomify.com/CVE-2021-24202/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/215/