https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:18:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-23962 EUVD-2026-23962 https://cve.radiocsirt.org/vuln/euvd-2026-23962 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24570 <p>The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.</p> <p>The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-24570 https://cve.radiocsirt.org/vuln/ghsa-8825-wr78-6h2r <p>The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.</p> <p>The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.</p> https://cve.radiocsirt.org/vuln/ghsa-8825-wr78-6h2r https://cve.radiocsirt.org/vuln/gsd-2021-24570 gsd-2021-24570 https://cve.radiocsirt.org/vuln/gsd-2021-24570