Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-25100

Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown GiveWP – Donation Plugin and Fundraising Platform

  • 2.17.3 to < 2.17.3affected

References