Not rated
CVE-2021-24524 The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level…
Description
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GiveWP – Donation Plugin and Fundraising Platform 2.12 | earliest → < 2.12.0 | 2.12.0 |
Other CVEs of GiveWP – Donation Plugin and Fundraising Platform
The 6 CVEs of GiveWP – Donation Plugin and Fundraising Platform →
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the…
Not rated
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow…
Not rated
CVE-2022-0252
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute…
Not rated
CVE-2021-25100
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in…
Not rated