CVE-2021-24618

CVE-2021-24618 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Donate With QRCode WordPress plugin versions prior to 1.4.5. The vulnerability stems from insufficient sanitization of the QRCode Image setting, combined with a lack of CSRF and capability checks. This allows authenticated users, including subscribers, or unauthenticated users via a CSRF attack, to inject malicious scripts. Rated as Medium severity (CVSS 5.4), the vulnerability requires user interaction (UI:R) and low privileges (PR:L) for exploitation, potentially leading to limited impact on confidentiality and integrity (C:L/I:L). While the attack complexity is low (AC:L), the scope is changed (S:C), indicating a broader impact on the affected system. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.