Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)

2021-07-2100:00:00

Muhammad Daffa

292

0.001 Low

EPSS

Percentile

22.9%

JSON

The plugin is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.

1. Go to /wp-admin/edit.php?post_type=donation
2. Add new donation
3. In the first or last name forms, add the XSS payload
4. Save and the XSS payload will be executed

References

www.wpcharitable.com/release-notes-1-6-51/

0.001 Low

EPSS

Percentile

22.9%

JSON

Related for WPEX-ID:A5837621-EE6E-4876-9F65-82658FC0341F