Lucene search
Asif Nawaz MinhasWPEX-ID:5A4774EC-C0EE-4C6B-92A6-FA10821EC336HistoryJul 26, 2021 - 12:00 a.m.
GiveWP < 2.12.0 - Authenticated Stored XSS
2021-07-2600:00:00
Asif Nawaz Minhas
327
0.001 Low
EPSS
Percentile
25.0%
The plugin did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
Put the following payload in any Donation Level Text field of a Donation Form (ie /wp-admin/post.php?post=9&action=edit&give_tab=form_field_options#form_field_options): "onmouseover=alert(/XSS/)//
Then view a page/post with the embed Donation Form and move the mouse over the related Donation Level the payload was injected in to trigger the XSSRelated
patchstack
patchstack
openvas
openvas
WordPress GiveWP Plugin < 2.12.0 XSS Vulnerability
2021-09-03 00:00:00
nvd
nvd
CVE-2021-24524
2021-08-23 12:15:09
cve
cve
CVE-2021-24524
2021-08-23 12:15:09
wpvulndb
wpvulndb
GiveWP < 2.12.0 - Authenticated Stored XSS
2021-07-26 00:00:00
prion
prion
Cross site scripting
2021-08-23 12:15:00
cvelist
cvelist
CVE-2021-24524 GiveWP < 2.12.0 - Authenticated Stored XSS
2021-08-23 11:09:59