CVE-2021-24244

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
bitorbit	WPBakery Page Builder (Visual Composer) Clipboard	>= 4.5.0, < 4.5.0*; >= 4.5.8, < 4.5.8

References

https://codecanyon.net/item/visual-composer-clipboard/8897711Product, Third Party Advisory
https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9Exploit, Third Party Advisory
https://codecanyon.net/item/visual-composer-clipboard/8897711Product, Third Party Advisory
https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9Exploit, Third Party Advisory

Timeline

Published: May 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-242456.1The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting CVE-2021-242465.4The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send CVE-2021-242475.4The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking a CVE-2021-242487.2The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported fi CVE-2021-242496.5The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For CVE-2021-24254.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.25 an CVE-2021-242505.4The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in CVE-2021-242514.3The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request For CVE-2021-242527.2The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, su CVE-2021-242538.8The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only chec CVE-2021-242547.2The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users CVE-2021-242555.4The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XS