WordPress GiveWP Plugin <= 3.6.1 is vulnerable to Cross Site Scripting (XSS)

Software GiveWP Type Plugin Vulnerable versions = 3.6.1 Fixed in 3.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1957 Patch priority Low CVSS severity Low 6.5 Developer Liquid Web / StellarWP PSID f3cbd83f12af Credits Ngô Thiên An ancorn Requir...

CVE-2024-1957

CVE-2024-1957 concerns GiveWP – Donation Plugin and Fundraising Platform for WordPress. It is a stored cross-site scripting (XSS) vulnerability in the plugin’s shortcodes, specifically via the ‘give_form’ shortcode in all versions up to and including 3.6.1, caused by insufficient input sanitizati...