CVE-2021-24315 Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

2021-05-1716:48:53

CWE-79

WPScan

www.cve.org

cve-2021-24315

givewp

donation plugin

authenticated

stored

cross-site scripting

xss

wordpress

stripe checkout

logo

email settings

EPSS

0.001

Percentile

21.8%

JSON

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

CNA Affected

[
  {
    "product": "GiveWP – Donation Plugin and Fundraising Platform",
    "vendor": "GiveWP",
    "versions": [
      {
        "lessThan": "2.10.4",
        "status": "affected",
        "version": "2.10.4",
        "versionType": "custom"
      }
    ]
  }
]