CVE-2021-24570CWE-352CWE-79

Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

published November 1, 2021

CVSS
—
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00504 · 42.2th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting
    cvelistv5