CVE-2021-24570
Medium
Description
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
SeverityMedium
CVSS4.3
Exploit probability—
ProductWpplugin Accept Donations With Paypal
PublishedNov 1, 2021
First seenNov 1, 2021
How to fix
Update
- wpplugin accept_donations_with_paypal1.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpplugin accept_donations_with_paypal | v < 1.3.1 | 1.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.