PT-2021-15852 · Givewp · Givewp

M0Ze + 1 · Published 2021-05-17 · Updated 2023-02-06 · CVE-2021-24315

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 2.10.4

Description The issue is related to authenticated Stored XSS, where the Background Image field of the Stripe Checkout Setting and the Logo field in the Email settings were not properly sanitised or escaped. This could lead to malicious code execution.

Recommendations For versions prior to 2.10.4, update to version 2.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Stripe Checkout Setting and Email settings to minimize the risk of exploitation. Avoid using the Background Image field and Logo field in the affected settings until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24315

Affected Products

Givewp

References · 4

• 🔥 https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2 · Exploit
• 🔥 https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24315 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24315 · Vendor Advisory