PT-2021-16134 · WordPress · Donate With Qrcode

[e-mail] Inc · Published 2021-09-20 · Updated 2022-12-20 · CVE-2021-24618

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Donate With QRCode WordPress plugin versions prior to 1.4.5

Description The issue is related to a Stored Cross-Site Scripting (XSS) attack. The plugin does not sanitise or escape its QRCode Image setting, allowing any authenticated user, or unauthenticated user via a CSRF vector, to update the setting and perform an attack. The lack of CSRF and capability checks in place when saving the setting enables any authenticated user, including those with low privileges such as subscribers, to update the setting.

Recommendations For versions prior to 1.4.5, update to version 1.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the QRCode Image setting to minimize the risk of exploitation. Additionally, restrict the ability of low-privileged users, such as subscribers, to update settings that could potentially be used for XSS attacks.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24618

Affected Products

Donate With Qrcode

References · 5

• 🔥 https://wpscan.com/vulnerability/d50b801a-16b5-45e9-a465-e3bb0445cb49 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24618 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24618 · Vendor Advisory
• https://t.me/cibsecurity/29088 · Telegram Post
• https://t.me/cvenotify/21145 · Telegram Post