CVE-2024-10876: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting
The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.8.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10876?
CVE-2024-10876 is classified as a medium severity vulnerability due to its potential for exploitation via reflected cross-site scripting.
How do I fix CVE-2024-10876?
To fix CVE-2024-10876, update the Charitable Donation Plugin for WordPress to a version newer than 1.8.3, which includes proper escaping.
What platforms are affected by CVE-2024-10876?
CVE-2024-10876 affects all versions of the Charitable Donation Plugin for WordPress up to and including version 1.8.3.
What type of vulnerability is CVE-2024-10876?
CVE-2024-10876 is a reflected cross-site scripting (XSS) vulnerability.
What causes the vulnerability in CVE-2024-10876?
The vulnerability in CVE-2024-10876 is caused by the use of add_query_arg and remove_query_arg without proper URL escaping.