CVE-2023-2082: Improper Neutralization of Input During Web Page Generation

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmcpostreception action. This makes it possible for authenticated attacker...