CVE-2021-24524 GiveWP < 2.12.0 - Authenticated Stored XSS

2021-08-2311:09:59

CWE-79

WPScan

www.cve.org

givewp

wordpress

authenticated

stored xss

donation forms

EPSS

0.001

Percentile

24.8%

JSON

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.

CNA Affected

[
  {
    "product": "GiveWP – Donation Plugin and Fundraising Platform",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.12.0",
        "status": "affected",
        "version": "2.12.0",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/5a4774ec-c0ee-4c6b-92a6-fa10821ec336

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24524