Filtered by vendor Wp-buy Subscriptions
Total 16 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-51484 1 Wp-buy 1 Login As User Or Customer \(user Switching\) 2024-11-21 9.8 Critical
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
CVE-2023-36678 1 Wp-buy 1 Wp Content Copy Protection \& No Right Click 2024-11-21 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.
CVE-2022-4305 1 Wp-buy 1 Login As User Or Customer \(user Switching\) 2024-11-21 9.8 Critical
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
CVE-2022-23983 1 Wp-buy 1 Wp Content Copy Protection \& No Right Click 2024-11-21 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
CVE-2021-24847 1 Wp-buy 1 Seo Redirection-301 Redirect Manager 2024-11-21 8.8 High
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed
CVE-2021-24829 1 Wp-buy 1 Visitor Traffic Real Time Statistics 2024-11-21 8.8 High
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
CVE-2021-24195 1 Wp-buy 1 Login As User Or Customer \(user Switching\) 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2021-24194 1 Wp-buy 1 Login Protection - Limit Failed Login Attempts 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2021-24193 1 Wp-buy 1 Visitor Traffic Real Time Statistics 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2021-24190 1 Wp-buy 1 Conditional Marketing Mailer 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2021-24189 1 Wp-buy 1 Captchinoo 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2021-24188 1 Wp-buy 1 Wp Content Copy Protection \& No Right Click 2024-11-21 8.8 High
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVE-2019-15832 1 Wp-buy 1 Visitor Traffic Real Time Statistics 2024-11-21 N/A
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.
CVE-2019-15831 1 Wp-buy 1 Visitor Traffic Real Time Statistics 2024-11-21 N/A
The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.
CVE-2024-49306 1 Wp-buy 1 Wp Content Copy Protection \& No Right Click 2024-10-22 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in WP-buy WP Content Copy Protection & No Right Click allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through 3.5.9.
CVE-2022-4534 1 Wp-buy 1 Limit Login Attempts 2024-10-10 5.3 Medium
The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.