CVE-2021-24570

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.50% chance of exploitation in the next 30 days, 41th percentile

Published

2021-11-01

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87

References

• CVE Record
• NVD entry

Related

• CVE-2021-24569
• CVE-2021-24571
• CVE-2021-24568
• CVE-2021-24572
• CVE-2021-24567
• CVE-2021-24574