WordPress Plugin Vulnerabilities
Buy Me a Coffee < 3.7 - Subscriber+ Stored Cross-Site Scripting
Description
The plugin does not properly sanitize and escape the 'text value' set via the 'bmc_post_reception' action, leading to potential Cross-Site Scripting.
Affects Plugins
Fixed in 3.7 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Lana Codes
Verified
No
WPVDB ID
Timeline
Publicly Published
2023-07-13 (about 2 years ago)
Added
2023-07-14 (about 2 years ago)
Last Updated
2023-07-14 (about 2 years ago)
WPScan 