CVE-2021-24315

Опубликовано: 17 мая 2021

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

Ссылки

https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2
Exploit
Third Party Advisory
https://m0ze.ru/vulnerability/%5B2021-04-02%5D-%5BWordPress%5D-%5BCWE-79%5D-GiveWP-WordPress-Plugin-v2.10.3.txt
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/006b37c9-641c-4676-a315-9b6053e001d2
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*

Версия до 2.10.4 (исключая)

EPSS

Процентиль: 61%

0.00414

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-fgwf-w654-q583