Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

2 records

Vendor: Donation Button Project Component: Donation Button Clear all filters
TI-2022-03673 CVE-2022-4004 · GHSA-48rf-c53v-4537

Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam

Priority MEDIUM 53

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affec…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00511 Published 2022-12-12 No fix listed
TI-2022-03674 CVE-2022-4005 · GHSA-2j67-wvp2-rc5h

Donation Button <= 4.0.0 - Contributor+ Stored XSS

Priority MEDIUM 58

The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0056 Published 2022-12-12 No fix listed