284 matches found
CVE-2022-4448 GiveWP < 2.24.0 - Contributor+ Stored XSS
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
VulnCheck KEV: CVE-2020-20627
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change...
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
WordPress plugin GiveWP 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
PT-2022-15551 · WordPress · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP WordPress plugin versions prior to 2.21.3 Description: The issue allows attackers to perform a Denial of Service DoS attack on the web server via a Cross-Site Request Forgery CSRF attack. This happens because the plugin lacks CSRF...
CVE-2022-31475
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-28700
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-28700
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
Design/Logic Flaw
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-31475 WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-31475 WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-31475
CVE-2022-31475 affects the GiveWP WordPress plugin and concerns an authenticated arbitrary file read via the export function in versions
CVE-2022-28700 WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
PT-2022-20753 · WordPress · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP plugin versions = 2.20.2 Description: The issue is related to an authenticated arbitrary file read vulnerability via the export function in the GiveWP plugin for WordPress. This vulnerability can be exploited by users with a custom...
WordPress plugin GiveWP 路径遍历漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2022-2117 GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been...
WordPress plugin GiveWP 信息泄露漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...