WordPress Plugin Vulnerabilities

Donorbox 7.1~7.1.1 - Stored Cross-Site Scripting via Shortcode

Description

In Donorbox WordPress plugin, one can perform an XSS attack via the included shortcode by inserting arbitrary HTML attributes.

This vulnerability was introduced in v7.1 and fixed in v7.1.2.

Proof of Concept

Affects Plugins

Plugin icon
donorbox-donation-form
Fixed in 7.1.2

References

URL
https://gist.github.com/sybrew/833bf49d81bc8246fba8dabf8a3ba12a

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Sybre Waaijer
Submitter
Sybre Waaijer
Submitter website
https://theseoframework.com/
Submitter twitter
SybreWaaijer
Verified
No
WPVDB ID
8c42ba42-f543-4a59-901a-62e62a491c53

Timeline

Publicly Published
2019-12-31 (about 6 years ago)
Added
2019-12-31 (about 6 years ago)
Last Updated
2020-01-01 (about 6 years ago)

Other

Published
Title
Published
2025-02-02
Title
SW Plus <= 2.1 - Reflected Cross-Site Scripting
Published
2023-07-24
Title
Custom Field Template < 2.6 - Reflected Cross-Site Scripting
Published
2023-02-02
Title
Image Hover Effects for Elementor with Lightbox and Flipbox < 3.0 - Reflected XSS
Published
2022-10-10
Title
Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting
Published
2024-08-16
Title
Allegiant <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting