Threat Entry Updated 2025-02-27

CVE-2024-1957 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-1957

MEDIUM CVSS 6.4 2024-04-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-27

CVE-2024-1424 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-1424

MEDIUM CVSS 6.4 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24524 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24524

MEDIUM CVSS 4.8 2021-08-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24315 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24315

MEDIUM CVSS 4.8 2021-05-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24213 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24213

MEDIUM CVSS 6.1 2021-04-12

Risk Score

Open Full Technical Breakdown