CVE-2021-25099: Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting
Published Feb 21, 2022
·Updated
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the formid parameter before outputting it back in the response of an unauthenticated request via the givecheckoutlogin AJAX action, leading to a Reflected Cross-Site Scripting
Affected Software
1 affected component
GiveWP GiveWP WordPress<2.17.3
Event History
Feb 21, 2022
CVE Published
via MITRE·10:45 AM
Data Sourced
via MITRE·10:45 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2021-25099.
2
What is the severity level of CVE-2021-25099?
The severity level of CVE-2021-25099 is medium (6.1).
3
What is the affected software version of CVE-2021-25099?
The affected software version of CVE-2021-25099 is GiveWP WordPress plugin before 2.17.3.
4
What is the CWE ID associated with CVE-2021-25099?
The CWE ID associated with CVE-2021-25099 is CWE-79.
5
How can I fix the vulnerability in GiveWP WordPress plugin?
To fix the vulnerability in GiveWP WordPress plugin, update to version 2.17.3 or later.