Not rated
CVE-2021-24570 The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which…
Description
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Accept Donations with PayPal 1.3 | earliest → < 1.3.1 | 1.3.1 |
Other CVEs of Accept Donations with PayPal
The 4 CVEs of Accept Donations with PayPal →
CVE-2021-24989
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure…
Not rated
CVE-2021-24815
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created…
Not rated
CVE-2021-24572
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which…
Not rated