PT-2023-17638

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.7 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the recieve post, bmc disconnect, name post, and widget post...

CVE-2023-2078: Missing Authorization

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for...

PT-2023-17636

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to 3.7 Description The issue allows unauthorized modification of data due to missing capability checks on the recieve post, bmc disconnect, name post, and widget post functions. This enabl...

CVE-2023-2578

The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2578

The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2578

The CVE-2023-2578 entry concerns the WordPress plugin Buy Me a Coffee (pre-3.7). The issue is due to insufficient sanitization/escaping of certain settings, enabling Stored XSS for high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Impact is descri...

CVE-2023-2578 Buy Me a Coffee < 3.7 - Admin+ Stored XSS

The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress plugin Buy Me a Coffee 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress Buy Me a Coffee Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Buy Me a Coffee Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2079 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5d565b582e78 Credits Lana Codes Required...

PT-2023-20296 · WordPress · Buy Me A Coffee

Name of the Vulnerable Software and Affected Versions: Buy Me a Coffee WordPress plugin versions prior to 3.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and esca...

CVE-2023-2578: Undefined Security Weakness

The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Buy Me a Coffee Plugin <= 3.7 is vulnerable to Broken Access Control

Software Buy Me a Coffee Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2078 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4f9e072d5272 Credits Lana Codes Required privilege...

WordPress Buy Me a Coffee Plugin <= 3.7 is vulnerable to Broken Access Control

Software Buy Me a Coffee Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25030 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID efd2e1e73286 Credits Abdi Pranata Required privilege...

Exploit for Improper Authentication in Wpdeveloper Essential_Addons_For_Elementor

WP-CVE-2023-32243 Python 2.7 Buy Coffee : Bitcoin $: 14nXhmR...

CVE-2023-28988

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin = 2.1.48 versions...

CVE-2023-28988 WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin = 2.1.48 versions...

WordPress Buy Me a Coffee Plugin < 3.7 is vulnerable to Cross Site Scripting (XSS)

Software Buy Me a Coffee Type Plugin Vulnerable versions 3.7 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2578 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b3db2558b5f1 Credits Felipe Restrepo Rodriguez...

Why a proactive detection and incident response plan is crucial for your organization

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Matt Suiche, Director...

Why a proactive detection and incident response plan is crucial for your organization

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Matt Suiche, Director...

Upgraded Q -> 3 from #306 [1683219251927]

Judge has assessed an item in Issue 306 as 3 risk. The relevant finding follows: L-01 Consider using OpenZeppelin’s SafeCast library to prevent unexpected overflows when casting from uint256 In the function buy and sell of the contract PrivatePool.sol the function first set the variables...