CVE-2024-3594: IDonate <= 1.9.0 - Admin+ Stored XSS
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3594?
CVE-2024-3594 has been classified as a high severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-3594?
To mitigate CVE-2024-3594, update the IDonate WordPress plugin to version 1.9.1 or higher, or ensure proper sanitization and escaping of any settings.
Who is affected by CVE-2024-3594?
CVE-2024-3594 affects users of the IDonate WordPress plugin version 1.9.0 and earlier, particularly those with high privilege roles like admin.
What is Stored Cross-Site Scripting in the context of CVE-2024-3594?
Stored Cross-Site Scripting occurs when an attacker can inject malicious scripts that are then stored and executed in the context of a user's session on the site.
Can CVE-2024-3594 be exploited in a multisite setup?
Yes, CVE-2024-3594 can be exploited in a multisite setup even when the unfiltered_html capability is disallowed for users.