CVE-2021-24570: Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-01 · updated 2026-06-17
Weakness: CWE-79

Description

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.

Affected products

Accept Donations with PayPal: before 1.3.1 — fixed in 1.3.1

How to fix

Upgrade to a fixed version: Accept Donations with PayPal 1.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24570 or the next vulnerability affects your stack