Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection

The plugin does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue PoC GET /wp-admin/admin.php?page=wppaytmdonation=delete=1%20AND%20SELECT%205581%20FROM%20SELECTSLEEP5Pjwy HTTP/1.1...

Charitable - Donation Plugin < 1.6.51 - Unauthenticated Stored Cross-Site Scripting

While fixing an Authenticated Stored Cross-Site Scripting issue https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f, the vendor identified another Cross-Site Scripting issue, which could be exploited by unauthenticated users and would be triggered in the context of a logged in...

Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature. PoC 1. Go to /wp-admin/edit.php?posttype=donation 2. Add new donation 3. In the first or last name forms, add the XSS payload 4. Save and the XSS payload will be...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-37197)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the GiveWP...

Cross site scripting

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated admin+ Stored XSS issues...

CVE-2021-24315 Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated admin+ Stored XSS issues...

CVE-2021-24315

CVE-2021-24315 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress, prior to version 2.10.4. The issue is an authenticated Stored XSS caused by insufficient sanitisation/escaping of the Background Image field in Stripe Checkout settings and the Logo field in Email settings. Ro...

CVE-2021-24213

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page...

CVE-2021-24213

The CVE-2021-24213 entry affects GiveWP (WordPress plugin) versions before 2.10.0. It is a reflected Cross-Site Scripting (XSS) vulnerability in the admin Donors page, triggered via the s parameter in the Donors page URL. Exploitation requires an admin to visit a crafted URL; successful exploitat...

WordPress Give - Donation Plugin < 2.3.1 XSS Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

WordPress Donation Plugin and Fundraising Platform Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation, which supports personal blog sites on servers running PHP and MySQL.WordPress Donation Plugin and Fundraising Platform is a plugin.... A cross-site scripting vulnerability exists in the WordPress Donation Plug...

Cross site scripting

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9909

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9909

The CVE concerns the WordPress GiveWP plugin (Donation Plugin and Fundraising Platform). Affected component: csv export functionality (wp-admin/edit.php) in GiveWP versions prior to 2.3.1. Root cause: improper handling/sanitization of input during CSV export leads to a Cross-Site Scripting (XSS) ...

PT-2019-19927 · Unknown · Donation Plugin/Fundraising Platform

Name of the Vulnerable Software and Affected Versions: Donation Plugin and Fundraising Platform versions prior to 2.3.1 Description: The issue concerns a cross-site scripting XSS vulnerability in the csv export functionality of the wp-admin/edit.php page. Recommendations: For versions prior to...

Give - Cross-Site Scripting (XSS)

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Donation <= 1.0 - SQL Injection

The WordPress Donation Plugin with Goals and Paypal IPN by NonprofitCMS.org WordPress plugin was affected by a SQL Injection security vulnerability...

WordPress Donation plugin <= 1.0 - SQL Injection

No description provided by source. Exploit Title: WordPress Donation plugin = 1.0 SQL Injection Vulnerability Date: 2011-08-31 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link:...

WordPress Plugin Donation 1.0 - SQL Injection

WordPress Plugin Donation 1.0 - SQL Injection Exploit Title: WordPress Donation plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $dId = $REQUEST"did"; ... $campaigns = $wpdb-getresults"SELECT FROM $tablename WHERE campid=$dId";...

WordPress Donation Plugin <= 1.0 - SQL Injection

Donation plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin...