GiveWP < 2.12.0 – Admin+ Stored XSS | CVE 2021-24524 | Plugin Vulnerabilities

Description

The plugin did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.

Proof of Concept

Put the following payload in any Donation Level Text field of a Donation Form (ie /wp-admin/post.php?post=9&action=edit&give_tab=form_field_options#form_field_options): "onmouseover=alert(/XSS/)//

Then view a page/post with the embed Donation Form and move the mouse over the related Donation Level the payload was injected in to trigger the XSS

Affects Plugins

Fixed in 2.12.0

References

CVE

URL

https://www.hackpertise.com/cve/5-cve-2021-24524/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

5a4774ec-c0ee-4c6b-92a6-fa10821ec336

Timeline

Publicly Published

2021-07-26 (about 4 years ago)

Added

2021-07-26 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2025-01-15

Title

Wishlist < 1.0.40 - Reflected Cross-Site Scripting

Published

2024-08-16

Title

Ultimate Store Kit Elementor Addons < 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-03-15

Title

Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS

Published

2023-09-25

Title

Order Delivery Date for WooCommerce < 3.20.1 - Reflected XSS

Published

2024-12-20

Title

Pingmeter Uptime Monitoring <= 1.0.3 - Reflected Cross-Site Scripting