VulnerabilityModified
CVE-2021-24570
The process to create a new button is lacking a CSRF check.
MEDIUM 4.3EPSS 0.50%
Does this matter?
Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own.
Description
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- EPSS
- 0.50% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-352
- Affected
- wpplugin/accept donations with paypal
- Source
- contact@wpscan.com
References
- https://plugins.trac.wordpress.org/changeset/2608073/Patch, Third Party Advisory
- https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2608073/Patch, Third Party Advisory
- https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.