Read the docs

Donation Button Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Donation Button Project records in CISA KEV

No Donation Button Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Donation Button 2 records MEDIUM

Records

2 records

TI-2022-03674 CVE-2022-4005 · GHSA-2j67-wvp2-rc5h

Donation Button <= 4.0.0 - Contributor+ Stored XSS

Priority MEDIUM 58

The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0056 Published 2022-12-12 No fix listed
TI-2022-03673 CVE-2022-4004 · GHSA-48rf-c53v-4537

Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

Priority MEDIUM 53

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affec…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00511 Published 2022-12-12 No fix listed
Open these records in search →