TI-2021-06855 Aliases CVE-2021-24570 GHSA-8825-wr78-6h2r

Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

LOW 21CWE-352Published 2021-11-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Tampering, Cross-site scripting
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-79.

Summary

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

Why it matters now

EPSS 0.00504 43rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Accept Donations with PayPal (Unknown): 1.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Accept Donations with PayPal	1.3.1 to before 1.3.1	1.3.1	Patch available	CNA

Accept Donations with PayPal VendorUnknown Affected 1.3.1 to before 1.3.1 Fixed in 1.3.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wpplugin:accept_donations_with_paypal::::::wordpress::*	before 1.3.1	Vulnerable	Scott Paterson

cpe:2.3:a:wpplugin:accept_donations_with_paypal:*:*:*:*:*:wordpress:*:* Versions before 1.3.1 Vulnerable ·Scott Paterson

Remediation

Fix · CNA Accept Donations with PayPal (Unknown) Fixed in 1.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2021-11-01
Accept Donations with PayPal 1.3.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2021-06857 Paypal Donation < 1.3.1 - CSRF to Arbitrary Post DeletionPriority LOW 20
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2021-24570
2026-10-03 Alias added: GHSA-8825-wr78-6h2r

References

Exploit 1

https://wpscan.com/vulnerability/5c73754c-eebe-424a-9d3b-ca83eb53bf87

Patch 1

https://plugins.trac.wordpress.org/changeset/2608073/

TI-2025-30014 WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
TI-2021-07268 Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF CVSS 3.1MEDIUM 6.5
TI-2021-07097 Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
TI-2021-06857 Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences