CveMateVulnerability intelligence

Wp Buy vulnerabilities

36 vulnerabilities

Known vulnerabilities in Wp Buy products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.

Products

23

Visitor Traffic Real Time Statistics6 vulnerabilities
Wp Content Copy Protection \& No Right Click6 vulnerabilities
Login As User Or Customer \(User Switching\)4 vulnerabilities
SEO Redirection Plugin – 301 Redirect Manager (Wordpress Plugin)2 vulnerabilities
Visitors Traffic Real Time Statistics2 vulnerabilities
WP Maintenance Mode & Site Under Construction2 vulnerabilities
404 Image Redirection (Replace Broken Images)1 vulnerabilities
Captchinoo1 vulnerabilities
Captchinoo, Google Recaptcha For Admin Login Page1 vulnerabilities
Conditional Marketing Mailer1 vulnerabilities
Limit Login Attempts1 vulnerabilities
Limit Login Attempts (Spam Protection)1 vulnerabilities
Login Protection Limit Failed Login Attempts1 vulnerabilities
Owl Carousel Slider1 vulnerabilities
Related Posts Widget With Thumbnails1 vulnerabilities
SEO Redirection1 vulnerabilities
Seo Redirection 301 Redirect Manager1 vulnerabilities
Tree Sitemap (Pages, Posts & Categories List)1 vulnerabilities
Visitor Traffic Real Time Statistics Pro1 vulnerabilities
Woocommerce Conditional Marketing Mailer1 vulnerabilities
Wordpress Related Posts With Thumbnails1 vulnerabilities
WP Content Copy Protection & No Right Click (Wordpress Plugin)1 vulnerabilities
WP Popup Window Maker1 vulnerabilities

CVE-2021-24189wordpresscaptchinoo-captcha-for-login-form-protection+25y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24190wordpresswp-maintenance-mode-site-under-construction+25y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24188wordpresswp-content-copy-protector+15y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24193wordpressvisitors-traffic-real-time-statistics+15y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24191wordpresswp-maintenance-mode-site-under-construction+25y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24195wordpresslogin-as-customer-or-user+15y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24847unknownseo redirection plugin – 301 redirect manager+24y ago17-11-2021 10:15

The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed CVE-2021-24192sitemap_projectsitemap+25y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2021-24829unknownvisitor traffic real time statistics+24y ago08-11-2021 17:35

The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue CVE-2021-24194wordpresswp-limit-failed-login-attempts+15y ago14-05-2021 11:38

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.CVE-2025-31569wordpressrelated-posts-list-grid-and-slider-all-in-one+11y ago31-03-2025 12:55

Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored XSS.This issue affects wordpress related Posts with thumbnails: from n/a through <= 3.0.0.1.CVE-2025-31570wordpressadvanced-css3-related-posts-widget+11y ago31-03-2025 12:55

Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue affects Related Posts Widget with Thumbnails: from n/a through <= 1.2.CVE-2025-49284wordpresswp-maintenance-mode-site-under-construction+11y ago06-06-2025 12:53

Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a through <= 4.3.CVE-2025-32266wordpressbroken-images-redirection+11y ago04-04-2025 15:59

Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request Forgery.This issue affects 404 Image Redirection (Replace Broken Images): from n/a through <= 1.4.CVE-2022-40695clogicaseo_redirection+23y ago18-11-2022 22:16

Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.CVE-2022-4305unknownlogin as user or customer+23y ago23-01-2023 14:31

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.CVE-2022-4534wordpresswp-limit-failed-login-attempts+12y ago08-10-2024 08:33

The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.CVE-2022-38704clogicaseo_redirection+24y ago23-09-2022 18:32

Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.CVE-2022-23983wordpresswp-content-copy-protection+24y ago21-02-2022 17:49

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).CVE-2024-54234wordpresswp-limit-failed-login-attempts+11y ago13-12-2024 14:24

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.