Lucene search
WPScanCVELIST:CVE-2021-24618HistorySep 20, 2021 - 10:06 a.m.
CVE-2021-24618 Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting
2021-09-2010:06:37
CWE-352
CWE-79
WPScan
www.cve.org
3
cve-2021-24618
donate with qrcode
stored cross-site scripting
wordpress plugin
EPSS
0.001
Percentile
21.2%
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
CNA Affected
[
{
"product": "Donate With QRCode",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.4.5",
"status": "affected",
"version": "1.4.5",
"versionType": "custom"
}
]
}
]Related
nvd
nvd
CVE-2021-24618
2021-09-20 10:15:09
wpvulndb
wpvulndb
Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting
2021-08-19 00:00:00
prion
prion
Cross site scripting
2021-09-20 10:15:00
cve
cve
CVE-2021-24618
2021-09-20 10:15:09
wpexploit
wpexploit
Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting
2021-08-19 00:00:00
patchstack
patchstack