Vulnerabilities > WP BUY > Visitor Traffic Real Time Statistics > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-11-08 | CVE-2021-24829 | SQL Injection vulnerability in Wp-Buy Visitor Traffic Real Time Statistics The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue | 6.5 |
| 2021-05-14 | CVE-2021-24193 | Unspecified vulnerability in Wp-Buy Visitor Traffic Real Time Statistics Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE. | 6.5 |
| 2019-08-30 | CVE-2019-15832 | Cross-Site Request Forgery (CSRF) vulnerability in Wp-Buy Visitor Traffic Real Time Statistics The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF. | 6.8 |
| 2019-08-30 | CVE-2019-15831 | Cross-Site Request Forgery (CSRF) vulnerability in Wp-Buy Visitor Traffic Real Time Statistics The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page. | 6.8 |