Vulnerability · Published Nov 1, 2021 · Assigned by WPScan

CVE-2021-24570Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

Medium 4.3

In plain English

A medium-severity cross-site request forgery in Accept Donations with PayPal from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Accept Donations with PayPal	1.3.1 – before 1.3.1

Weakness: CWE-352, CWE-79

References

https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87 x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2608073/ x_refsource_CONFIRM