CVE-2021-24570

MEDIUM

Accept Donations with PayPal < 1.3.1 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2608073/

Scores

CVSS v3 4.3
EPSS 0.0049
EPSS Percentile 38.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
wpplugin/accept_donations_with_paypal < 1.3.1
Published Nov 01, 2021
Tracked Since Feb 18, 2026