Cross site request forgery (csrf)

The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1610 Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF

The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1610

CVE-2022-1610 affects the WordPress plugin Seamless Donations (versions before 5.1.9). The root cause is a missing CSRF check when updating settings, which could let a logged-in attacker perform a CSRF attack to change settings. Public references (NVD, RH, CNVD, CVE lists) corroborate the vulnera...

WordPress plugin Seamless Donations 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. WordPress Seamless Donations plugin versions prior to 5.1.9 are vulnerable to cross-site request...

Seamless Donations < 5.1.9 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit; Some link: https://google.com input type="text" name="dgxdonateemailanon" value="You have requested th...

WordPress Seamless Donations plugin <= 5.1.8 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Seamless Donations plugin versions = 5.1.8. Solution Update the WordPress Seamless Donations plugin to the latest available version at least 5.1.9...

WordPress Donations Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

Cross site scripting

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433

The CVE-2022-29433 entry concerns the WordPress Donations plugin (versions ≤ 1.8). The connected documents confirm an authenticated Stored Cross-Site Scripting (XSS) vulnerability where parameters are not properly sanitized/escaped, allowing a contributor+ (authenticated) user to trigger XSS. Imp...

CVE-2022-29433 https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433 https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

Donations <= 1.8 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting...

WordPress plugin Donations 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

WordPress Donations plugin <= 1.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance WordPress Donations plugin versions = 1.8. Solution Deactivate and delete. This plugin has been closed as of February 28, 2022 and is not available for download. Reason: Security Issue...

Shelter donations result in wrong internal balance if fee-on-transfer token is used

Judge @GalloDaSballo has assessed the 2nd Low-severity item in QA Report 66 as Medium risk. The relevant finding follows: … In case of a fee-on-transfer ERC20 token the savedTokens balance will not represent the actual balance of the contract: You can either disable the use of fee-on-transfer...

CVE-2022-0782

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0782

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...