Not rated
CVE-2021-25099 The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back…
Description
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GiveWP – Donation Plugin and Fundraising Platform 2.17 | earliest → < 2.17.3 | 2.17.3 |
Other CVEs of GiveWP – Donation Plugin and Fundraising Platform
The 6 CVEs of GiveWP – Donation Plugin and Fundraising Platform →
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the…
Not rated
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow…
Not rated
CVE-2022-0252
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute…
Not rated
CVE-2021-25100
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in…
Not rated