CVE-2023-2082 in Buy Me a Coffee Plugin
Summary
by MITRE • 07/14/2023
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-2082 affects the "Buy Me a Coffee – Button and Widget Plugin" for WordPress, representing a critical cross-site scripting flaw that undermines the security integrity of affected websites. This vulnerability exists within plugin versions up to and including 3.6, where the developers failed to implement proper input sanitization and output escaping mechanisms for user-controllable data. The flaw specifically manifests in the handling of the 'text value' parameter that is set through the bmc_post_reception action, creating an avenue for malicious code injection that can persist across user sessions and page views.
The technical exploitation of this vulnerability requires an authenticated attacker with subscriber-level permissions or higher, which significantly reduces the barrier to successful exploitation compared to vulnerabilities requiring administrative access. The flaw falls under CWE-79, which categorizes cross-site scripting vulnerabilities as a result of insufficient input validation and output escaping. This particular implementation weakness allows attackers to inject malicious scripts that execute automatically when unsuspecting users browse pages containing the injected content, creating a persistent threat vector that can be leveraged for various malicious activities including session hijacking, data theft, and further system compromise.
From an operational perspective, the impact of this vulnerability extends beyond simple script execution as it enables attackers to manipulate the plugin's functionality and potentially gain deeper access to the affected WordPress installation. The injected scripts can target various parts of the website including user dashboards, admin interfaces, and public-facing pages, creating multiple attack surfaces for further exploitation. This vulnerability directly maps to several ATT&CK techniques including T1566 for social engineering and T1059 for command and scripting interpreter usage, as attackers can leverage the persistent nature of the injected scripts to establish more sophisticated attack chains.
The security implications of CVE-2023-2082 are particularly concerning given the widespread use of WordPress plugins and the relatively low permission requirements for exploitation. The vulnerability demonstrates poor security practices in input validation and output escaping that are fundamental to preventing XSS attacks in web applications. Organizations running affected versions of this plugin should immediately implement mitigation strategies including updating to the patched version, implementing proper input sanitization measures, and monitoring for suspicious activity in user-generated content areas. Additionally, administrators should consider implementing content security policies and regular security audits to identify similar vulnerabilities in other plugins and themes that may be susceptible to similar exploitation techniques.