Non notée
CVE-2021-25099 The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back…
Description
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| GiveWP – Donation Plugin and Fundraising Platform 2.17 | premières → < 2.17.3 | 2.17.3 |
Références
- wpscan.com wpscan.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de GiveWP – Donation Plugin and Fundraising Platform
Les 6 CVE de GiveWP – Donation Plugin and Fundraising Platform →
CVE-2022-2260
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the…
Non notée
CVE-2022-2215
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow…
Non notée
CVE-2022-0252
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute…
Non notée
CVE-2021-25100
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in…
Non notée