PT-2022-15275 · WordPress · Givewp

Raad Haddad · Published 2022-08-01 · Updated 2022-08-05 · CVE-2022-2215

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 2.21.3

Description The issue concerns the improper sanitization and escaping of currency settings, potentially allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks. This is particularly relevant in setups where the unfiltered html capability is disallowed, such as in multisite configurations.

Recommendations For versions prior to 2.21.3, update to version 2.21.3 or later to resolve the issue. As a temporary workaround, consider restricting the ability to modify currency settings to only trusted administrators and ensuring that all users with high privileges are aware of the potential for Stored Cross-Site Scripting attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-2215

Affected Products

Givewp

References · 4

• 🔥 https://wpscan.com/vulnerability/daa9b6c1-1ee1-434c-9f88-fd273b7e20bb · Exploit
• https://osv.dev/vulnerability/CVE-2022-2215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2215 · Security Note
• https://t.me/cibsecurity/47321 · Telegram Post