Buymeacoffee

Buy Me A Coffee

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2023-25030

  • EPSS 0.11%
  • Veröffentlicht 12.06.2024 10:15:23
  • Zuletzt bearbeitet 21.11.2024 07:48:57

Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7.

5.4

CVE-2023-2082

Exploit
  • EPSS 0.09%
  • Veröffentlicht 14.07.2023 05:15:09
  • Zuletzt bearbeitet 21.11.2024 07:57:54

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. ...

4.3

CVE-2023-2078

Exploit
  • EPSS 0.04%
  • Veröffentlicht 11.07.2023 03:15:09
  • Zuletzt bearbeitet 21.11.2024 07:57:53

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and...

5.3

CVE-2023-2079

Exploit
  • EPSS 0.05%
  • Veröffentlicht 11.07.2023 03:15:09
  • Zuletzt bearbeitet 21.11.2024 07:57:53

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and includi...

4.8

CVE-2023-2578

Exploit
  • EPSS 0.09%
  • Veröffentlicht 10.07.2023 16:15:51
  • Zuletzt bearbeitet 21.11.2024 07:58:52

The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallo...