773 matches found
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
Cross site request forgery (csrf)
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
Cross site scripting
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-2260 GiveWP < 2.21.3 - DoS via CSRF
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the...
CVE-2022-2260
The CVE-2022-2260 entry concerns the GiveWP WordPress plugin (versions prior to 2.21.3) with CSRF protection missing when exporting data and unvalidated export parameters (e.g., dates). This can allow a logged-in admin to cause a DoS by the plugin repeatedly querying the database, overwhelming CP...
CVE-2022-2215
The CVE-2022-2215 entry concerns the GiveWP WordPress plugin (versions before 2.21.3). The vulnerability stems from improper sanitisation/escaping of currency settings, enabling Stored Cross-Site Scripting when unfiltered_html is disallowed (e.g., multisite). Affected component: currency settings...
CVE-2022-2215 GiveWP < 2.21.3 - Admin+ Stored Cross-Site Scripting
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...
PT-2022-15551 · WordPress · Givewp
Name of the Vulnerable Software and Affected Versions: GiveWP WordPress plugin versions prior to 2.21.3 Description: The issue allows attackers to perform a Denial of Service DoS attack on the web server via a Cross-Site Request Forgery CSRF attack. This happens because the plugin lacks CSRF...
WordPress plugin GiveWP 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
WordPress plugin GiveWP 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress GiveWP Plugin <= 2.20.2 Multiple Vulnerabilities
The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
CVE-2022-31475
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-28700
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-28700
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...
CVE-2022-31475
Authenticated custom plugin role Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin = 2.20.2 at WordPress...