CVE-2021-24315: falha em GiveWP – Donation Plugin and Fundraising…
Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.7%
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
Produtos afetados
GiveWP · GiveWP – Donation Plugin and Fundraising PlatformCVEs relacionadas — GiveWP – Donation Plugin and Fundraising…
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24213—GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)EPSS 1.4%CVE-2023-32513HIGHWordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object InjectionEPSS 0.6%CVE-2022-40312MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2023-51415MEDIUMWordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2023-25450MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%