CVE-2022-2215 GiveWP < 2.21.3 - Admin+ Stored Cross-Site Scripting

2022-08-0112:50:18

CWE-79

WPScan

www.cve.org

givewp

stored cross-site scripting

cve-2022-2215

admin+ role

wordpress plugin

unfiltered_html

currency settings.

EPSS

0.001

Percentile

24.8%

JSON

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

CNA Affected

[
  {
    "product": "GiveWP – Donation Plugin and Fundraising Platform",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.21.3",
        "status": "affected",
        "version": "2.21.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/daa9b6c1-1ee1-434c-9f88-fd273b7e20bb

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2022-2215