Wp Buy vulnerabilities, page 2
36 vulnerabilities
Known vulnerabilities in Wp Buy products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.
CVE-2024-13627unknownowl carousel slider+2
EPSS score0.84%
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.CVE-2024-52421wordpresseasy-popup-lightbox-maker+1EPSS score0.18%
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.CVE-2024-49306wordpresswp-content-copy-protector+1EPSS score0.24%
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.CVE-2024-6690unknownwccp-pro+2EPSS score0.53%
The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sitesCVE-2024-6693unknownwccp-pro+2EPSS score0.31%
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2019-15832wordpressvisitors-traffic-real-time-statistics+1EPSS score0.80%
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.CVE-2019-15831wordpressvisitors-traffic-real-time-statistics+1EPSS score0.74%
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.CVE-2026-2936wordpressvisitors-traffic-real-time-statistics+1EPSS score0.32%
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.CVE-2026-52702wordpressseo-redirection+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.CVE-2026-93367wordpressvisitors-traffic-real-time-statistics-pro+1EPSS score0.19%
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is registered for logged-out callers (wp_ajax_nopriv_ahcpro_track_visitor) and stores $_POST['page_title'] with NO sanitization, keeping it raw in the ahc_title_traffic.til_page_title column. When an administrator opens the plugin's dashboard, the 'Traffic by Title' DataTable renders that stored value as innerHTML without output escaping, executing arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject web scripts that run in an administrator's session.CVE-2026-28175wordpressvisitors-traffic-real-time-statistics+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.CVE-2026-97341wordpressvisitors-traffic-real-time-statistics+1EPSS score0.27%
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires no authentication, no nonce, and no capability — the wp_ajax_nopriv_ahcfree_track_visitor endpoint accepts the forged X-Real-IP header from any unauthenticated HTTP request and stores the entity-encoded payload verbatim in the database.CVE-2023-51484wordpresslogin-as-customer-or-user+1EPSS score0.70%
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.CVE-2023-47557wordpressvisitors-traffic-real-time-statistics+1EPSS score0.37%
Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/a through <= 7.2.CVE-2023-36678wordpresswp-content-copy-protector+1EPSS score0.40%
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.CVE-2023-7247unknownlogin as user or customer+2EPSS score0.64%
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.