CVE-2022-2260: vulnerability in GiveWP – Donation Plugin and Fundraising…
GiveWP < 2.21.3 - DoS via CSRF
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.4%
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
Affected products
Unknown · GiveWP – Donation Plugin and Fundraising PlatformRelated CVEs — GiveWP – Donation Plugin and Fundraising…
In the same product, most dangerous first.
CVE-2021-25099—Give < 2.17.3 - Unauthenticated Reflected Cross-Site ScriptingEPSS 2.1%CVE-2022-0252—Give < 2.17.3 - Reflected Cross-Site Scripting via Import ToolEPSS 0.9%CVE-2021-25100—Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms DashboardEPSS 0.9%CVE-2022-2215—GiveWP < 2.21.3 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2021-24524—GiveWP < 2.12.0 - Authenticated Stored XSSEPSS 0.6%