Vulnerability · Published Sep 20, 2021 · Assigned by WPScan

CVE-2021-24618Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting

Medium 5.4

In plain English

A medium-severity cross-site scripting in Donate With QRCode from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Donate With QRCode	1.4.5 – before 1.4.5

Weakness: CWE-79, CWE-352

References

https://wpscan.com/vulnerability/d50b801a-16b5-45e9-a465-e3bb0445cb49 x_refsource_MISC