Lucene search

K

Wp-buy Security Vulnerabilities

cve
cve

CVE-2023-51484

Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through...

9.8CVSS

6.9AI Score

0.0004EPSS

2024-04-25 09:15 AM
63
cve
cve

CVE-2022-4305

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin...

9.8CVSS

9.3AI Score

0.067EPSS

2023-01-23 03:15 PM
36
cve
cve

CVE-2021-24847

The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is...

8.8CVSS

8.8AI Score

0.001EPSS

2021-11-17 11:15 AM
22
cve
cve

CVE-2023-36678

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5...

5.9CVSS

4.8AI Score

0.0004EPSS

2023-08-05 11:15 PM
23
cve
cve

CVE-2022-40695

Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on...

8.8CVSS

8.4AI Score

0.001EPSS

2022-11-18 11:15 PM
31
4
cve
cve

CVE-2022-38704

Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection...

5.4CVSS

4.6AI Score

0.001EPSS

2022-09-23 07:15 PM
36
7
cve
cve

CVE-2022-23983

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <=...

8.8CVSS

8.7AI Score

0.001EPSS

2022-02-21 06:15 PM
73
cve
cve

CVE-2021-24829

The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection...

8.8CVSS

8.9AI Score

0.001EPSS

2021-11-08 06:15 PM
20
cve
cve

CVE-2021-24194

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from...

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
22
2
cve
cve

CVE-2021-24193

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog,.....

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
27
5
cve
cve

CVE-2021-24195

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then...

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
22
2
cve
cve

CVE-2021-24192

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers...

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
19
3
cve
cve

CVE-2021-24191

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from...

8.8CVSS

8.7AI Score

0.001EPSS

2021-05-14 12:15 PM
24
2
cve
cve

CVE-2021-24190

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then...

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
17
5
cve
cve

CVE-2021-24189

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from....

8.8CVSS

8.6AI Score

0.001EPSS

2021-05-14 12:15 PM
32
cve
cve

CVE-2021-24188

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from...

8.8CVSS

8.7AI Score

0.001EPSS

2021-05-14 12:15 PM
22
4
cve
cve

CVE-2019-15831

The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings...

8.8CVSS

8.7AI Score

0.001EPSS

2019-08-30 02:15 PM
33
cve
cve

CVE-2019-15832

The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has...

8.8CVSS

8.7AI Score

0.001EPSS

2019-08-30 02:15 PM
32