CVE-2021-24572 Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could...

CVE-2021-24570

The CVE-2021-24570 vulnerability affects the WordPress plugin Accept Donations with PayPal up to version 1.3.1. The issue arises from a missing CSRF check in the process that creates donation buttons (which are stored as posts), enabling an authenticated admin to create new buttons. Additionally,...

CVE-2021-24570 Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of t...

WordPress plugin Accept Donations with PayPal 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2021-16087 · WordPress · Accept Donations With Paypal

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal WordPress plugin versions prior to 1.3.1 Description: The issue is related to a lack of CSRF check in the process of creating new donation buttons, which are internally treated as posts. This allows an attacker to...

WordPress 跨站请求伪造漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Accept Donations with PayPal plugin in versions prior to 1.3.1 has a cross-site request forgery...

WordPress Accept Donations with PayPal plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3.1. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.2...

Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create/Edit a Button and put the following payload in the Amount Menu Name field...

WordPress Accept Donations with PayPal plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3.1. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.2...

Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/Edit a Button and put the following payload in the Amount Menu Name field...

WordPress Accept Donations with PayPal plugin <= 1.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Accept Donations with PayPal plugin versions = 1.3. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.1...

WordPress Subscriptions & Memberships for PayPal plugin <= 1.1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Subscriptions & Memberships for PayPal plugin versions = 1.1.2. Solution Update the WordPress Subscriptions & Memberships for PayPal plugin to the latest available version at least 1.1.3...

WordPress Easy PayPal Events plugin <= 1.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Easy PayPal Events plugin versions = 1.1.1. Solution Update the WordPress Easy PayPal Events plugin to the latest available version at least 1.1.2...

Prototype Pollution

paypal-adaptive is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the PayPal function...

Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS

Impact URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's firs...

GHSA-25FX-MXC2-76G7 Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS

Impact URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's firs...

Information Disclosure

sylius/paypalplugin is vulnerable to information disclosure. An attacker is able to predict the URL to the payment done page, after checkout due to the use of autoincremented payment id in page creation.Prefilled credit card form shows customer's first and last name resulting in sensitive...

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

CVE-2021-41120 Unauthorized access to Credit card form in sylius/paypal-plugin

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...