wp-buy 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
公開された問題は vendor risk csrf、vendor risk cross-site scripting, and vendor risk sql injection に関連することが多く、vendor surface production workloads and vendor surface software deployment の文脈で vendor impact session compromise and vendor impact data exposure などの暴露リスクを伴う場合があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-6693 | The wccp-pro WordPress plugin before 15.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | [email protected] | 4.8 | 0.26% | 2025-05-15 | 2026-06-17 |
| CVE-2024-6690 | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites | [email protected] | 6.1 | 0.47% | 2025-05-15 | 2026-06-17 |
| CVE-2024-13627 | The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | [email protected] | 4.7 | 0.80% | 2025-02-17 | 2026-06-17 |
| CVE-2024-49306 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9. | [email protected] | 5.3 | 0.19% | 2024-10-20 | 2026-06-17 |
| CVE-2023-7247 | The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site. | [email protected] | 4.9 | 0.64% | 2024-03-11 | 2026-06-17 |
| CVE-2023-36678 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions. | [email protected] | 5.9 | 0.34% | 2023-08-05 | 2026-06-17 |
| CVE-2022-4305 | The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. | [email protected] | 9.8 | 38.62% | 2023-01-23 | 2026-06-17 |
| CVE-2022-23983 | Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4). | [email protected] | 4.3 | 0.40% | 2022-02-21 | 2026-06-17 |
| CVE-2021-24847 | The importFromRedirection AJAX action of the SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed | [email protected] | 8.8 | 1.32% | 2021-11-17 | 2026-06-16 |
| CVE-2021-24829 | The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue | [email protected] | 8.8 | 1.32% | 2021-11-08 | 2026-06-16 |
| CVE-2021-24195 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2021-24194 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2021-24193 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2021-24190 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2021-24189 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2021-24188 | Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | [email protected] | 8.8 | 1.32% | 2021-05-14 | 2026-06-16 |
| CVE-2019-15832 | The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. | [email protected] | 8.8 | 0.80% | 2019-08-30 | 2026-06-16 |
| CVE-2019-15831 | The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. | [email protected] | 8.8 | 0.74% | 2019-08-30 | 2026-06-16 |