CVE-2022-29433 https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433 https://patchstack.com/database/vulnerability/nd-donations/wordpress-donations-plugin-1-8-authenticated-stored-cross-site-scripting-xss-vulnerability

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

CVE-2022-29433

The CVE-2022-29433 entry concerns the WordPress Donations plugin (versions ≤ 1.8). The connected documents confirm an authenticated Stored Cross-Site Scripting (XSS) vulnerability where parameters are not properly sanitized/escaped, allowing a contributor+ (authenticated) user to trigger XSS. Imp...

CVE-2022-29433

Authenticated contributor or higher role Cross-Site Scripting XSS vulnerability in Donations plugin = 1.8 on WordPress...

WordPress plugin Donations 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress...

Donations <= 1.8 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting...

WordPress Donations plugin <= 1.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance WordPress Donations plugin versions = 1.8. Solution Deactivate and delete. This plugin has been closed as of February 28, 2022 and is not available for download. Reason: Security Issue...

Shelter donations result in wrong internal balance if fee-on-transfer token is used

Judge @GalloDaSballo has assessed the 2nd Low-severity item in QA Report 66 as Medium risk. The relevant finding follows: … In case of a fee-on-transfer ERC20 token the savedTokens balance will not represent the actual balance of the contract: You can either disable the use of fee-on-transfer...

CVE-2022-0782

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0782

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0782

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...

Sql injection

The Donations WordPress plugin through 1.8 does not sanitise and escape the nddonationsid parameter before using it in a SQL statement via the nddonationssinglecauseformvalidatefieldsphpfunction AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0782

CVE-2022-0782 affects the WordPress Donations plugin (versions up to 1.8). The root cause is improper sanitisation/escaping of the nd_donations_id parameter, which is used unsafely in an SQL statement inside the unauthenticated AJAX action nd_donations_single_cause_form_validate_fields_php_functi...

WordPress plugin Donations SQL注入漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin Donations plugin SQL injection vulnerability, the vulnerability stems from the inability to properly clean up and escape the...

WordPress Donations plugin <= 1.8 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Donations plugin versions = 1.8. Solution Deactivate and delete. This plugin has been closed as of February 28, 2022 and is not available for download. This closure is temporary, pending a full review...

Ukraine’s Defense—and Hacktivists—Have Raised Over $4M in Crypto

Russia’s invasion into the country sparked a surge of crypto donations to resistance groups...

CVE-2021-24989

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog...

CVE-2021-24989

Summary (CVE-2021-24989) : The WordPress plugin “Accept Donations with PayPal” is vulnerable in versions prior to 1.3.4 due to missing CSRF protection and inadequate verification that the target post belongs to the plugin. This enables a logged-in admin to delete arbitrary posts via a CSRF abuse ...

WordPress Kudos Donations plugin <= 3.1.1 - Arbitrary Items Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Items Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by WPScanTeam in WordPress Kudos Donations plugin versions = 3.1.1. Solution Update the WordPress Kudos Donations plugin to the latest available version at least 3.1.2...

Kudos Donations < 3.1.2 - Arbitrary Items Deletion via CSRF

The plugin has a logic flaw in its CSRF checks when deleting items such as Donors, Transactions, Subscriptions etc, allowing attackers to make a logged in admin delete them PoC https://example.com/wp-admin/admin.php?page=kudos-transactions=delete=1...