1025 matches found
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-40211 Patch priority Low CVSS severity Low 5.9 Developer Liquid Web / StellarWP PSID d8e7c0818a7e Credits Rafie Muhammad Patchsta...
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25450 Patch priority Low CVSS severity Low 5.4 Developer Liquid Web / StellarWP PSID 62aa59a77c22 Credits Rio Darmawan Requir...
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2022-40312 Patch priority Low CVSS severity Low 5.5 Developer Liquid Web / StellarWP PSID bdfc49563a46 Credits Rafie Muhammad...
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23668 Patch priority Low CVSS severity Low 6.5 Developer Liquid Web / StellarWP PSID 17d2bd271dd1 Credits Rafshanzani Suhada...
GiveWP < 2.25.2 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks...
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Arbitrary Content Deletion
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A5: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-23672 Patch priority Low CVSS severity Low 5.4 Developer Liquid Web / StellarWP PSID baa27979c9e7 Credits Rafshanzani Suhada...
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection
Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-22719 Patch priority Low CVSS severity Low 4.7 Developer Liquid Web / StellarWP PSID 7ead0bb10ca7 Credits Rafshanzani Suhada Required privilege...
GiveWP < 2.25.2 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
GiveWP < 2.25.2 - Admin+ Server-Side Request Forgery
The plugin does not validate a parameter before making a request to it, which could allow users with a role of Administrator to perform an SSRF attack...
WordPress GiveWP Plugin < 2.24.0 XSS Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:givewp:givewp"; ifdescription...
CVE-2022-4448
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2022-4448
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Cross site scripting
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2022-4448 GiveWP < 2.24.0 - Contributor+ Stored XSS
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2022-4448 GiveWP < 2.24.0 - Contributor+ Stored XSS
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2022-4448
CVE-2022-4448 affects the GiveWP WordPress plugin prior to version 2.24.0. The issue is improper validation/escaping of shortcode attributes before output, enabling Stored XSS for users with the contributor role or higher when the shortcode is embedded in a page/post. Impact is stored XSS with ac...
WordPress plugin GiveWP 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-14492
Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 2.24.0 Description The issue concerns a lack of validation and escaping of certain shortcode attributes in the GiveWP WordPress plugin, which could allow users with the contributor role and above to...
CVE-2022-4448: Undefined Security Weakness
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
