Cross-Site Scripting Vulnerability in Buy Me a Coffee Plugin for WordPress

CVE-2023-2082

Summary

The Buy Me a Coffee – Button and Widget Plugin for WordPress is subject to a Cross-Site Scripting vulnerability due to inadequate sanitization and escaping techniques on the 'text value' resulting from the bmc_post_reception action. This flaw allows authenticated users with subscriber-level permissions and higher to inject arbitrary scripts into the WordPress pages, which can be executed when victims access those pages, potentially leading to malicious actions such as session hijacking or data theft.

References