WordPress Donations plugin <= 1.8 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Donations plugin versions = 1.8. Solution Deactivate and delete. This plugin has been closed as of February 28, 2022 and is not available for download. This closure is temporary, pending a full review...

Ukraine’s Defense—and Hacktivists—Have Raised Over $4M in Crypto

Russia’s invasion into the country sparked a surge of crypto donations to resistance groups...

CVE-2021-24989

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog...

CVE-2021-24989

Summary (CVE-2021-24989) : The WordPress plugin “Accept Donations with PayPal” is vulnerable in versions prior to 1.3.4 due to missing CSRF protection and inadequate verification that the target post belongs to the plugin. This enables a logged-in admin to delete arbitrary posts via a CSRF abuse ...

CVE-2021-24989: Cross-Site Request Forgery (CSRF)

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog...

PT-2022-9550

Name of the Vulnerable Software and Affected Versions Accept Donations with PayPal WordPress plugin versions prior to 1.3.4 Description The issue allows attackers to make a logged-in admin delete arbitrary posts from the blog due to the lack of a CSRF check and insufficient validation of the post...

Kudos Donations < 3.1.2 - Arbitrary Items Deletion via CSRF

The plugin has a logic flaw in its CSRF checks when deleting items such as Donors, Transactions, Subscriptions etc, allowing attackers to make a logged in admin delete them PoC https://example.com/wp-admin/admin.php?page=kudos-transactions=delete=1...

WordPress Kudos Donations plugin <= 3.1.1 - Arbitrary Items Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Items Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Kudos Donations plugin versions = 3.1.1. Solution Update the WordPress Kudos Donations plugin to the latest available version at least 3.1.2...

WordPress Accept Donations with PayPal plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Accept Donations with PayPal plugin has a cross-site scripting vulnerability in versions prior to 1.3.2, which stems...

CVE-2021-24815

The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24815

The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24815

The CVE-2021-24815 entry concerns the WordPress plugin “Accept Donations with PayPal” (pre-1.3.2). The vulnerability arises from insufficient escaping of the Amount Menu Name field when creating Buttons, enabling stored Cross-Site Scripting that could be exploited by a high-privilege user. No exp...

CVE-2021-24815: Improper Neutralization of Input During Web Page Generation

The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress Accept Donations with PayPal plugin has a cross-site scripting vulnerability in versions prior to 1.3.2, which stems...

PT-2021-16307

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal WordPress plugin versions prior to 1.3.2 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the Amount Menu Name field of created Buttons not being properly escaped,...

WordPress Accept Donations with PayPal plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Accept Donations with PayPal plugin in versions prior to 1.3.1 has a cross-site request forgery...

CVE-2021-24570

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

Cross site scripting

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

CVE-2021-24570

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

CVE-2021-24572

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could...