# Vulnerabilities published in 2021


- [CVE-2021-24201](https://insights.sbomify.com/CVE-2021-24201/): Elementor < 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element (medium 5.4)
- [CVE-2021-24200](https://insights.sbomify.com/CVE-2021-24200/): wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter (medium 6.5)
- [CVE-2021-2420](https://insights.sbomify.com/CVE-2021-2420/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24199](https://insights.sbomify.com/CVE-2021-24199/): wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter (medium 6.5)
- [CVE-2021-24198](https://insights.sbomify.com/CVE-2021-24198/): wpDataTables < 3.4.2 - Improper Access Control leading to Table Data Deletion (high 8.1)
- [CVE-2021-24197](https://insights.sbomify.com/CVE-2021-24197/): wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission Takeover (high 8.1)
- [CVE-2021-24196](https://insights.sbomify.com/CVE-2021-24196/): Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24195](https://insights.sbomify.com/CVE-2021-24195/): Login as User or Customer (User Switching) < 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24194](https://insights.sbomify.com/CVE-2021-24194/): Login Protection - Limit Failed Login Attempts < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24193](https://insights.sbomify.com/CVE-2021-24193/): Visitor Traffic Real Time Statistics < 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24192](https://insights.sbomify.com/CVE-2021-24192/): Tree Sitemap < 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24191](https://insights.sbomify.com/CVE-2021-24191/): WP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24190](https://insights.sbomify.com/CVE-2021-24190/): WooCommerce Conditional Marketing Mailer < 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-2419](https://insights.sbomify.com/CVE-2021-2419/): Denial of service in Outside In Technology (high 7.5)
- [CVE-2021-24189](https://insights.sbomify.com/CVE-2021-24189/): Missing authorization in Captchinoo, Google recaptcha for admin login page (high 8.8)
- [CVE-2021-24188](https://insights.sbomify.com/CVE-2021-24188/): WP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User (high 8.8)
- [CVE-2021-24187](https://insights.sbomify.com/CVE-2021-24187/): SEO Redirection < 6.4 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24186](https://insights.sbomify.com/CVE-2021-24186/): Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id (medium 6.5)
- [CVE-2021-24185](https://insights.sbomify.com/CVE-2021-24185/): Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating (medium 6.5)
- [CVE-2021-24184](https://insights.sbomify.com/CVE-2021-24184/): Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation (high 8.8)
- [CVE-2021-24183](https://insights.sbomify.com/CVE-2021-24183/): Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form (medium 6.5)
- [CVE-2021-24182](https://insights.sbomify.com/CVE-2021-24182/): Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question (medium 6.5)
- [CVE-2021-24181](https://insights.sbomify.com/CVE-2021-24181/): Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct (medium 6.5)
- [CVE-2021-24180](https://insights.sbomify.com/CVE-2021-24180/): Related Posts for WordPress < 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-2418](https://insights.sbomify.com/CVE-2021-2418/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24179](https://insights.sbomify.com/CVE-2021-24179/): Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE (high 8.8)
- [CVE-2021-24178](https://insights.sbomify.com/CVE-2021-24178/): Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS (high 8.8)
- [CVE-2021-24177](https://insights.sbomify.com/CVE-2021-24177/): WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24176](https://insights.sbomify.com/CVE-2021-24176/): JH 404 Logger <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24175](https://insights.sbomify.com/CVE-2021-24175/): The Plus Addons for Elementor Page Builder < 4.1.7 - Authentication Bypass (critical 9.8)
- [CVE-2021-24174](https://insights.sbomify.com/CVE-2021-24174/): Database Backups <= 1.2.2.6 - CSRF to Backup Download (high 8.1)
- [CVE-2021-24173](https://insights.sbomify.com/CVE-2021-24173/): VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24172](https://insights.sbomify.com/CVE-2021-24172/): VM Backups <= 1.0 - CSRF to Database Backup Download (medium 4.3)
- [CVE-2021-24171](https://insights.sbomify.com/CVE-2021-24171/): WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2021-24170](https://insights.sbomify.com/CVE-2021-24170/): User Profile Picture < 2.5.0 - Sensitive Information Disclosure (high 7.5)
- [CVE-2021-2417](https://insights.sbomify.com/CVE-2021-2417/): Other in MySQL Server (medium 6.0)
- [CVE-2021-24169](https://insights.sbomify.com/CVE-2021-24169/): Advanced Order Export For WooCommerce < 3.1.8 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24168](https://insights.sbomify.com/CVE-2021-24168/): Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24167](https://insights.sbomify.com/CVE-2021-24167/): Web-Stat < 1.4.1 - API Key Disclosure (high 7.5)
- [CVE-2021-24166](https://insights.sbomify.com/CVE-2021-24166/): Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection (medium 5.4)
- [CVE-2021-24165](https://insights.sbomify.com/CVE-2021-24165/): Ninja Forms < 3.4.34 - Administrator Open Redirect (medium 6.1)
- [CVE-2021-24164](https://insights.sbomify.com/CVE-2021-24164/): Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure (medium 4.3)
- [CVE-2021-24163](https://insights.sbomify.com/CVE-2021-24163/): Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure (high 8.8)
- [CVE-2021-24162](https://insights.sbomify.com/CVE-2021-24162/): Responsive Menu < 4.0.4 - CSRF to Settings Update (high 8.8)
- [CVE-2021-24161](https://insights.sbomify.com/CVE-2021-24161/): Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload (high 8.8)
- [CVE-2021-24160](https://insights.sbomify.com/CVE-2021-24160/): Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload (high 8.8)
- [CVE-2021-2416](https://insights.sbomify.com/CVE-2021-2416/): Denial of service in Communications Session Border Controller (medium 4.9)
- [CVE-2021-24159](https://insights.sbomify.com/CVE-2021-24159/): Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting (high 8.8)
- [CVE-2021-24158](https://insights.sbomify.com/CVE-2021-24158/): Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation (medium 6.5)
- [CVE-2021-24157](https://insights.sbomify.com/CVE-2021-24157/): Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Stored Cross Site Scripting (medium 5.4)
- [CVE-2021-24156](https://insights.sbomify.com/CVE-2021-24156/): Testimonial Rotator <= 3.0.3 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24155](https://insights.sbomify.com/CVE-2021-24155/): Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload (high 7.2)
- [CVE-2021-24154](https://insights.sbomify.com/CVE-2021-24154/): Theme Editor < 2.6 - Authenticated Arbitrary File Download (medium 4.9)
- [CVE-2021-24153](https://insights.sbomify.com/CVE-2021-24153/): Yoast SEO < 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24152](https://insights.sbomify.com/CVE-2021-24152/): Popup Builder < 3.74 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24151](https://insights.sbomify.com/CVE-2021-24151/): WP Editor < 1.2.7 - Authenticated SQL injection (high 7.2)
- [CVE-2021-24150](https://insights.sbomify.com/CVE-2021-24150/): Like Button Rating < 2.6.32 - Unauthenticated Full-Read SSRF (high 7.5)
- [CVE-2021-2415](https://insights.sbomify.com/CVE-2021-2415/): Other in Time and Labor (high 8.1)
- [CVE-2021-24149](https://insights.sbomify.com/CVE-2021-24149/): Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24148](https://insights.sbomify.com/CVE-2021-24148/): MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple (critical 9.8)
- [CVE-2021-24147](https://insights.sbomify.com/CVE-2021-24147/): Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24146](https://insights.sbomify.com/CVE-2021-24146/): Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export (high 7.5)
- [CVE-2021-24145](https://insights.sbomify.com/CVE-2021-24145/): Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE (high 7.2)
- [CVE-2021-24144](https://insights.sbomify.com/CVE-2021-24144/): Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection (high 7.8)
- [CVE-2021-24143](https://insights.sbomify.com/CVE-2021-24143/): AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24142](https://insights.sbomify.com/CVE-2021-24142/): 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24141](https://insights.sbomify.com/CVE-2021-24141/): Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection (high 7.2)
- [CVE-2021-24140](https://insights.sbomify.com/CVE-2021-24140/): Ajax Load More < 5.3.2 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-2414](https://insights.sbomify.com/CVE-2021-2414/): Other in Communications Session Border Controller (medium 6.8)
- [CVE-2021-24139](https://insights.sbomify.com/CVE-2021-24139/): Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2021-24138](https://insights.sbomify.com/CVE-2021-24138/): AdRotate < 5.8.4 - Authenticated SQL Injection (medium 5.5)
- [CVE-2021-24137](https://insights.sbomify.com/CVE-2021-24137/): Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection (high 8.8)
- [CVE-2021-24136](https://insights.sbomify.com/CVE-2021-24136/): Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24135](https://insights.sbomify.com/CVE-2021-24135/): WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS (medium 6.1)
- [CVE-2021-24134](https://insights.sbomify.com/CVE-2021-24134/): Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS (medium 4.8)
- [CVE-2021-24133](https://insights.sbomify.com/CVE-2021-24133/): ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings (medium 4.3)
- [CVE-2021-24132](https://insights.sbomify.com/CVE-2021-24132/): Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection (high 8.8)
- [CVE-2021-24131](https://insights.sbomify.com/CVE-2021-24131/): Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections (high 7.2)
- [CVE-2021-24130](https://insights.sbomify.com/CVE-2021-24130/): WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24129](https://insights.sbomify.com/CVE-2021-24129/): Themify Portfolio Post < 1.1.6 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24128](https://insights.sbomify.com/CVE-2021-24128/): Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-24127](https://insights.sbomify.com/CVE-2021-24127/): ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS (medium 5.4)
- [CVE-2021-24126](https://insights.sbomify.com/CVE-2021-24126/): Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-24125](https://insights.sbomify.com/CVE-2021-24125/): Contact Form Submissions < 1.7.1 - Authenticated SQL Injection (high 7.2)
- [CVE-2021-24124](https://insights.sbomify.com/CVE-2021-24124/): WP Shieldon 1.6.3 - Unauthenticated Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-24123](https://insights.sbomify.com/CVE-2021-24123/): PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE (high 7.2)
- [CVE-2021-24122](https://insights.sbomify.com/CVE-2021-24122/): Apache Tomcat information disclosure (medium 5.9)
- [CVE-2021-2412](https://insights.sbomify.com/CVE-2021-2412/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2021-24119](https://insights.sbomify.com/CVE-2021-24119/): Information disclosure in arm:mbed tls (medium 4.9)
- [CVE-2021-24117](https://insights.sbomify.com/CVE-2021-24117/): Information disclosure in apache:teaclave sgx sdk (medium 4.9)
- [CVE-2021-24116](https://insights.sbomify.com/CVE-2021-24116/): Information disclosure in wolfssl:wolfssl (medium 4.9)
- [CVE-2021-24115](https://insights.sbomify.com/CVE-2021-24115/): Weak cryptography in botan project:botan (critical 9.8)
- [CVE-2021-24114](https://insights.sbomify.com/CVE-2021-24114/): Microsoft Teams iOS Information Disclosure Vulnerability (medium 5.7)
- [CVE-2021-24113](https://insights.sbomify.com/CVE-2021-24113/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (medium 5.4)
- [CVE-2021-24112](https://insights.sbomify.com/CVE-2021-24112/): .NET Core Remote Code Execution Vulnerability (high 8.1)
- [CVE-2021-24111](https://insights.sbomify.com/CVE-2021-24111/): .NET Framework Denial of Service Vulnerability (high 7.5)
- [CVE-2021-24110](https://insights.sbomify.com/CVE-2021-24110/): HEVC Video Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2021-2411](https://insights.sbomify.com/CVE-2021-2411/): Denial of service in MySQL Cluster (low 3.7)
- [CVE-2021-24109](https://insights.sbomify.com/CVE-2021-24109/): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2021-24108](https://insights.sbomify.com/CVE-2021-24108/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/216/