GiveWP – Donation Plugin and Fundraising Platform, 717766ce1be5195d5e623f03d5a72452f68d01e6
- CVE, Research URL
- Published on
- Mar 08, 2023
- Research Description
- GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form_grid' shortcode in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 2.25.2.
- Status
-
vulnerable