Filtered by vendor Wpplugin Subscriptions
Total 8 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-24989 1 Wpplugin 1 Accept Donations With Paypal 2024-08-03 6.5 Medium
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
CVE-2021-24815 1 Wpplugin 1 Accept Donations With Paypal 2024-08-03 4.8 Medium
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2021-24570 1 Wpplugin 1 Accept Donations With Paypal 2024-08-03 4.3 Medium
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
CVE-2021-24572 1 Wpplugin 1 Accept Donations With Paypal 2024-08-03 4.3 Medium
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts
CVE-2022-4628 1 Wpplugin 1 Easy Paypal Buy Now Button 2024-08-03 5.4 Medium
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2023-47239 1 Wpplugin 1 Easy Paypal Shopping Cart 2024-08-02 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Paterson Easy PayPal Shopping Cart plugin <= 1.1.10 versions.
CVE-2023-24405 1 Wpplugin 1 Paypal \& Stripe Add-on 2024-08-02 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on plugin <= 1.9.3 versions.
CVE-2023-24395 1 Wpplugin 1 Contact Form 7 Redirect \& Thank You Page 2024-08-02 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.