CVE-2022-1396CWE-79

CVE-2022-1396: vulnerability in Donorbox – Free Recurring Donation Form

Donorbox < 7.1.7 - Admin+ Stored Cross-Site Scripting

Published · Updated

Follow this CVE+ Monitor Donorbox – Free Recurring Donation Form

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.0%
The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Affected products
Unknown · Donorbox – Free Recurring Donation Form