Read the docs
TI-2021-06607 Aliases CVE-2021-24315GHSA-fgwf-w654-q583

Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

Why it matters now

EPSS 0.00664 51st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed GiveWP – Donation Plugin and Fundraising Platform (GiveWP): 2.10.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiveWPGiveWP – Donation Plugin and Fundraising Platform2.10.4 to before 2.10.42.10.4Patch availableCNA
  • GiveWP – Donation Plugin and Fundraising Platform VendorGiveWP Affected 2.10.4 to before 2.10.4 Fixed in 2.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*before 2.10.4VulnerableGiveWP
  • cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:* Versions before 2.10.4 Vulnerable ·GiveWP

Remediation

  • Fix · CNA GiveWP – Donation Plugin and Fundraising Platform (GiveWP) Fixed in 2.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24315
  2. 2026-10-03 Alias added: GHSA-fgwf-w654-q583
  3. 2026-10-05 EPSS moved to the 50th–90th percentile

References

Exploit 2

  • TI-2024-05498 Deserialization of untrusted data in stellarwp GiveWP – Donation Plugin and Fundraising… CVSS 3.1CRITICAL 10.0
  • TI-2023-00215 GiveWP < 2.24.1 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
  • TI-2024-07745 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-04065 GiveWP < 2.24.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2024-11060 Give < 3.19.0 - Reflected XSS CVSS 3.1MEDIUM 4.8
  • TI-2025-00775 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences