Wp-buy vulnerabilities
We track 10 vulnerabilities in Wp-buy products across 9 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2026.
Latest Wp-buy vulnerabilities
- 7.2 High severity
Visitor Traffic Real Time Statistics: Improper Neutralization of Input During Web Page Generation
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes i
- 7.2 High severity
Visitor Traffic Real Time Statistics pro: Improper Neutralization of Input During Web Page Generation
The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is regi
- 7.2 High severity
Visitor Traffic Real Time Statistics: Improper Neutralization of Input During Web Page Generation
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possib
- 7.1 High severity
Related Posts Widget with Thumbnails: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy Related Posts Widget with Thumbnails advanced-css3-related-posts-widget allows Stored XSS.This issue affects Related Posts Widget with Thumbnails: from n/a through <= 1.2.
- 7.1 High severity
wordpress related Posts with thumbnails: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy wordpress related Posts with thumbnails related-posts-list-grid-and-slider-all-in-one allows Stored XSS.This issue affects wordpress related Posts with thumbnails: from n/a through <= 3.0.0.1.
- 9.3 Critical severity
Limit Login Attempts: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.
- 7.1 High severity
WP Popup Window Maker: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Popup Window Maker easy-popup-lightbox-maker allows Stored XSS.This issue affects WP Popup Window Maker: from n/a through <= 2.0.
- 8.8 High severity
WP Content Copy Protection & No Right Click: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.
- 9.8 Critical severity
Login as User or Customer (User Switching): Improper Authentication
Improper Authentication vulnerability in wp-buy Login as User or Customer (User Switching) allows Privilege Escalation.This issue affects Login as User or Customer (User Switching): from n/a through 3.8.
- 8.8 High severity
WP Content Copy Protection & No Right Click…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).