Wp-Buy: Security Vulnerabilities
The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites
CVSS Score
6.1
EPSS Score
0.0
Published
2025-05-15
The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score
4.8
EPSS Score
0.0
Published
2025-05-15
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score
4.7
EPSS Score
0.0
Published
2025-02-17
Cross-Site Request Forgery (CSRF) vulnerability in WP-buy WP Content Copy Protection & No Right Click allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through 3.5.9.
CVSS Score
4.3
EPSS Score
0.0
Published
2024-10-20
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
CVSS Score
4.9
EPSS Score
0.003
Published
2024-03-11
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.
CVSS Score
5.9
EPSS Score
0.001
Published
2023-08-05
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
CVSS Score
9.8
EPSS Score
0.89
Published
2023-01-23
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
CVSS Score
4.3
EPSS Score
0.001
Published
2022-02-21
The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed
CVSS Score
8.8
EPSS Score
0.007
Published
2021-11-17
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
CVSS Score
8.8
EPSS Score
0.007
Published
2021-11-08
Page 1