# cve.now: Wp-buy

The newest entries naming Wp-buy as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97341](https://cve.now/CVE-2026-97341.md): Visitor Traffic Real Time Statistics \<= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header (CVSS 7.2)
- [CVE-2026-93367](https://cve.now/CVE-2026-93367.md): Visitors Traffic Real Time Statistics Pro \<= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro\_track\_visitor (page\_title) (CVSS 7.2)
- [CVE-2026-28175](https://cve.now/CVE-2026-28175.md): WordPress Visitors Traffic Real Time Statistics plugin \<= 8.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-52702](https://cve.now/CVE-2026-52702.md): WordPress SEO Redirection plugin \<= 9.17 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-2936](https://cve.now/CVE-2026-2936.md): Visitor Traffic Real Time Statistics \<= 8.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-49284](https://cve.now/CVE-2025-49284.md): WordPress WP Maintenance Mode & Site Under Construction plugin \<= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-32266](https://cve.now/CVE-2025-32266.md): WordPress 404 Image Redirection (Replace Broken Images) plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-31570](https://cve.now/CVE-2025-31570.md): WordPress Related Posts Widget with Thumbnails plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2025-31569](https://cve.now/CVE-2025-31569.md): WordPress wordpress related Posts with thumbnails plugin \<= 3.0.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2023-47557](https://cve.now/CVE-2023-47557.md): WordPress Visitor Traffic Real Time Statistics plugin \<= 7.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-54234](https://cve.now/CVE-2024-54234.md): WordPress Limit Login Attempts plugin \<= 5.5 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-52421](https://cve.now/CVE-2024-52421.md): WordPress WP Popup Window Maker plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1)
- [CVE-2024-49306](https://cve.now/CVE-2024-49306.md): WordPress WP Content Copy Protection & No Right Click plugin \<= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2022-4534](https://cve.now/CVE-2022-4534.md): Limit Login Attempts (Spam Protection) \<= 5.3 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 5.3)
- [CVE-2023-51484](https://cve.now/CVE-2023-51484.md): WordPress Login as User or Customer plugin \<= 3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
- [CVE-2023-36678](https://cve.now/CVE-2023-36678.md): WordPress WP Content Copy Protection & No Right Click Plugin \<= 3.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2022-40695](https://cve.now/CVE-2022-40695.md): WordPress SEO Redirection Plugin plugin \<= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities (CVSS 5.4)
- [CVE-2022-38704](https://cve.now/CVE-2022-38704.md): WordPress SEO Redirection plugin \<= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2022-23983](https://cve.now/CVE-2022-23983.md): WordPress WP Content Copy Protection & No Right Click plugin \<= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability (CVSS 4.3)
- [CVE-2021-24195](https://cve.now/CVE-2021-24195.md): Login as User or Customer (User Switching) \< 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24194](https://cve.now/CVE-2021-24194.md): Login Protection - Limit Failed Login Attempts \< 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24193](https://cve.now/CVE-2021-24193.md): Visitor Traffic Real Time Statistics \< 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24192](https://cve.now/CVE-2021-24192.md): Tree Sitemap \< 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24191](https://cve.now/CVE-2021-24191.md): WP Maintenance Mode & Site Under Construction \< 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24190](https://cve.now/CVE-2021-24190.md): WooCommerce Conditional Marketing Mailer \< 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24189](https://cve.now/CVE-2021-24189.md): Captchinoo, Google recaptcha for admin login page \< 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)
- [CVE-2021-24188](https://cve.now/CVE-2021-24188.md): WP Content Copy Protection & No Right Click \< 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wp-buy
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.