CVE-2021-24315

Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

State: Published
Severity: Not scored
Published: May 17, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

Scores

The record has no CVSS score.

Weaknesses

CWE-79 Cross-site Scripting (XSS)

Affected Products

Product	Versions
GiveWP – Donation Plugin and Fundraising PlatformGiveWP	2.10.4 to before 2.10.4Affected

References

https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2
https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.