408 matches found
CVE-2025-31569
Cross-Site Request Forgery CSRF vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored XSS.This issue affects wordpress related Posts with thumbnails: from n/a through = 3.0.0.1...
CVE-2025-31569
Technical details for CVE-2025-31569 are not provided in the supplied documents. Monitor for updates.
WordPress دکمه، شبکه اجتماعی خرید plugin <= 2.0.6 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by kuteminh11 - VNPT Cyber Immunity in WordPress Plugin دکمه، شبکه اجتماعی خرید versions = 2.0.6...
MAL-2025-2255 Malicious code in ember-js-buy (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24179f2ae6d315fef8213c658f3e09ac85864b27355682956318b77f10e22a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ember-js-buy (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24179f2ae6d315fef8213c658f3e09ac85864b27355682956318b77f10e22a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
m.buy-scores.com Cross Site Scripting vulnerability OBB-4033483
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2025-7380 · WordPress · Widget Buy.Box
Name of the Vulnerable Software and Affected Versions: Widget BUY.BOX plugin for WordPress versions up to, and including, 3.1.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'buybox-widget' shortcode due to insufficient input sanitization and output escaping on...
WordPress Widget BUY.BOX plugin <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Widget BUY.BOX versions = 3.1.5...
PT-2025-1869 · WordPress · Linear
Name of the Vulnerable Software and Affected Versions: Linear plugin for WordPress versions up to, and including, 2.7.12 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'linear block buy commissions' shortcode due to insufficient input sanitization and output...
CVE-2023-47557
Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/a through = 7.2...
CVE-2024-10854
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...
CVE-2024-10853
The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeorder AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-10854
CVE-2024-10854 concerns the WordPress plugin Buy one click WooCommerce (<= 2.2.9). The root cause is a missing capability check on the AJAX action buy_one_click_import_options , allowing authenticated users with Subscriber-level access and above to modify/import plugin settings. The vulnerabil...
WordPress plugin Buy one click WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...
WordPress plugin Buy one click WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...
PT-2024-16591 · WordPress · Buy One Click Woocommerce Plugin
Name of the Vulnerable Software and Affected Versions: Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description: The issue arises from a missing capability check on the buy one click export options AJAX action, allowing authenticated attackers with...
WordPress plugin Buy one click WooCommerce 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...
WordPress Buy one click WooCommerce Plugin <= 2.2.9 is vulnerable to Broken Access Control
Software Buy one click WooCommerce Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10852 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a5a826444a0c Credits incognito Required...
CVE-2024-43973 WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through = 2.8.11...
CVE-2024-50497
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BuyNowDepot Advanced Online Ordering and Delivery Platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through 2.0...