Non notée
CVE-2021-24570 The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which…
Description
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Accept Donations with PayPal 1.3 | premières → < 1.3.1 | 1.3.1 |
Autres CVE de Accept Donations with PayPal
Les 4 CVE de Accept Donations with PayPal →
CVE-2021-24989
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure…
Non notée
CVE-2021-24815
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created…
Non notée
CVE-2021-24572
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which…
Non notée