Wp-Buy
34 CVEs across 26 Wp-Buy products. Browse Wp-Buy vulnerabilities, severities, and proof-of-concept exploits.
Wp-Buy products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28175 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. |
CVE-2026-52702 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. |
CVE-2026-2936 | High | 7.2 | 2026-04-04 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to… |
CVE-2025-49284 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cros… |
CVE-2024-6693 | Medium | 4.8 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2024-6690 | Medium | 6.1 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites |
CVE-2025-32266 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request For… |
CVE-2025-31570 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue… |
CVE-2025-31569 | High | 7.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored X… |
CVE-2024-13627 | Medium | 4.7 | 2025-02-17 | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cro… |
CVE-2023-47557 | Medium | 4.3 | 2025-01-02 | Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configu… |
CVE-2024-54234 | Critical | 9.3 | 2024-12-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempt… |
CVE-2024-52421 | High | 7.1 | 2024-11-19 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window… |
CVE-2024-49306 | Medium | 5.3 | 2024-10-20 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forge… |
CVE-2022-4534 | Medium | 5.3 | 2024-10-08 | The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insu… |
CVE-2023-51484 | Critical | 9.8 | 2024-04-25 | Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Cust… |
CVE-2023-7247 | Medium | 4.9 | 2024-03-11 | The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site. |
CVE-2023-36678 | Medium | 5.9 | 2023-08-05 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions. |
CVE-2022-4305 | Critical | 9.8 | 2023-01-23 | The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could all… |
CVE-2022-40695 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. |
CVE-2022-38704 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. |
CVE-2022-23983 | Medium | 4.3 | 2022-02-21 | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (v… |
CVE-2021-24847 | High | 8.8 | 2021-11-17 | The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, do… |
CVE-2021-24829 | High | 8.8 | 2021-11-08 | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (ava… |
CVE-2021-24195 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin befor… |
CVE-2021-24194 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin b… |
CVE-2021-24193 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12… |
CVE-2021-24192 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (… |
CVE-2021-24191 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin be… |
CVE-2021-24190 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before… |
CVE-2021-24189 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugi… |
CVE-2021-24188 | High | 8.8 | 2021-05-14 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin befo… |
CVE-2019-15832 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. |
CVE-2019-15831 | High | 8.8 | 2019-08-30 | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. |