CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Stored XSS.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.4.5.
Explanation of Vulnerability in Simple Terms
Accept Donations with PayPal & Stripe versions 1.4.5 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the donation plugin without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page while logged into the WordPress site.
What an attacker can do
Perform unwanted actions on the donation plugin by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
Attackers can modify donation settings, alter payment configurations, or redirect funds without the site owner's knowledge.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges or authentication by the attacker required.
Key dates
External resources
