Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: GiveWP – Donation Plugin and Fundraising Platform 2.17.3 Clear all filters
TI-2022-00187 CVE-2022-0252 · GHSA-f986-8rx2-8pq2

Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool

Priority LOW 29

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00866 Published 2022-02-21 Fixed in 2.17.3 CWE-79
TI-2021-07378 CVE-2021-25100 · GHSA-7389-xmqp-86xr

Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard

Priority LOW 29

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00866 Published 2022-02-21 Fixed in 2.17.3 CWE-79
TI-2021-07377 CVE-2021-25099 · GHSA-qvv8-jxqg-p2pc

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

Priority LOW 31

The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a R…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02145 Published 2022-02-21 Fixed in 2.17.3 CWE-79