PT-2023-17641 · WordPress · Buy Me A Coffee – Button/Widget Plugin

István Márton + 1 · Published 2023-07-14 · Updated 2023-07-27 · CVE-2023-2082

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.6

Description The issue arises from insufficient sanitization and escaping on the text value set via the bmc post reception action, allowing authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts into pages. These scripts execute whenever a victim accesses a page with the injected scripts.

Recommendations For versions up to, and including, 3.6, update to a version that addresses the insufficient sanitization and escaping issue. As a temporary workaround, consider restricting access to the bmc post reception action to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2082

Affected Products

Buy Me A Coffee – Button/Widget Plugin

References · 7

• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/includes/class-buy-me-a-coffee.php?rev=2319979#L162 · Exploit
• 🔥 https://plugins.trac.wordpress.org/browser/buymeacoffee/trunk/admin/class-buy-me-a-coffee-admin.php?rev=2816542 · Exploit
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fbuymeacoffee%2Ftags%2F3.6&old=2922493&new_path=%2Fbuymeacoffee%2Ftags%2F3.7&new=2922493&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2023-2082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2082 · Security Note
• https://t.me/cvenotify/55310 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ed9f8948-085b-4ac5-befd-c70085aa23cd?source=cve · Note