Donate With Qrcode Vulnerabilities

The Donate With QRCode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.5. This is due to missing or incorrect nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update arbitrary plugin settings via a forged r...

CVSS:

8.8

Affected:

up to 1.4.5

Fix:

No patched version reported

Disclosed:

Aug 19, 2021

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscr...

CVSS:

5.4

Affected:

up to 1.4.4

Fixed in:

1.4.5

Disclosed:

Aug 19, 2021

CVE-2021-24618 on NVD →