CVE-2023-2082

Name of the Vulnerable Software and Affected Versions Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.6

Description The issue arises from insufficient sanitization and escaping on the text value set via the bmc post reception action, allowing authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts into pages. These scripts execute whenever a victim accesses a page with the injected scripts.

Recommendations For versions up to, and including, 3.6, update to a version that addresses the insufficient sanitization and escaping issue. As a temporary workaround, consider restricting access to the bmc post reception action to minimize the risk of exploitation.