Buymeacoffee Vulnerabilities

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-le...

CVSS:

6.4

Affected:

up to 3.6

Fixed in:

3.7

Disclosed:

Jul 13, 2023

CVE-2023-2082 on NVD →

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for authenticated attackers, w...

CVSS:

7.3

Affected:

up to 3.7

Fixed in:

3.8

Disclosed:

Jul 10, 2023

CVE-2023-2078 on NVD →

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and including, 3.7. This makes it possible for unauthenticated attackers to updat...

CVSS:

7.1

Affected:

up to 3.7

Fixed in:

3.8

Disclosed:

Jul 10, 2023

CVE-2023-2079 on NVD →

The Buy Me a Coffee – Button and Widget Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions a...

CVSS:

4.4

Affected:

up to 3.6

Fixed in:

3.7

Disclosed:

Jun 19, 2023

CVE-2023-2578 on NVD →