{"vulnerability": "CVE-2021-24213", "sightings": [{"uuid": "f1a36d19-6088-46b2-a463-534e6542b306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24213.yaml", "content": "", "creation_timestamp": "2026-01-06T13:27:39.000000Z"}, {"uuid": "ce992ba6-bf76-4704-b4ef-8e07f4ebaed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mbuej75idf2d", "content": "", "creation_timestamp": "2026-01-07T21:03:19.549447Z"}, {"uuid": "3d414a6a-0983-4973-b1a6-e0f25a4d5351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/477", "content": "CVE-2021-24213 WordPress GiveWP 2.9.7 \u53cd\u5c04\u578bXSS\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-24213_WordPress_GiveWP_2.9.7_%E5%8F%8D%E5%B0%84%E5%9E%8BXSS%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-22T02:01:46.000000Z"}, {"uuid": "37195028-5436-461d-b433-c9e9cd72ee33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "seen", "source": "https://t.me/hacking_Attack/2217", "content": "Exploit Collector\nWordPress GiveWP 2.9.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png \nWordPress GiveWP plugin version 2.9.7 suffers from a cross site scripting vulnerability.\n\nMD5 | e1d2d3f9920ae4f2a8d888e6f91a3b5e\n\nDownload\n# Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting\n# Date: 3/23/2021\n# Exploit Author: Austin Bentley\n# Vendor Homepage: https://givewp.com/\n# Software Link: https://wordpress.org/plugins/give/\n# Version: 2.9.7\n# Tested on: Windows 7\n# CVE: CVE-2021-24213\nExploitation requirements: Admin must visit payload URL. Default config.\nTested on: GiveWP 2.9.7, Wordpress 5.7, XAMPP 7.4.16, Firefox 86.0.1. Default configs on all products.\nVulnerable since: 2.4.0, Jan 16th 2019, commit 097c4d0ab964493776950381ed64498040395f6b\nActive Installations: 100,000+ per https://wordpress.org/plugins/give/\nResearcher: Austin Bentley (https://bentl.ee/)\nDetailed writeup available at httpS://bentl.ee/posts/cve-givewp/\n\nPoC URL:\nhttp://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors\n\nResponse:\n--- SNIP ---\n\">\n--- SNIP ---\nDisclosure Log:\n3/21/2021 -- Emailed GiveWP for security contact information\n3/22/2021 -- WPScan CNA issued CVE-2021-24213 (un-released)\n3/22/2021 -- Provided vendor with PoC\n3/22/2021 -- Vendor provided fix in 2.10.0\n3/23/2021 -- Fix validated, article posted, CVE unlocked\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:50.146576Z"}, {"uuid": "73b2123b-56e8-413d-882a-5cfa29720180", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "seen", "source": "https://t.me/hacking_Attack/2217", "content": "Exploit Collector\nWordPress GiveWP 2.9.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png \nWordPress GiveWP plugin version 2.9.7 suffers from a cross site scripting vulnerability.\n\nMD5 | e1d2d3f9920ae4f2a8d888e6f91a3b5e\n\nDownload\n# Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting\n# Date: 3/23/2021\n# Exploit Author: Austin Bentley\n# Vendor Homepage: https://givewp.com/\n# Software Link: https://wordpress.org/plugins/give/\n# Version: 2.9.7\n# Tested on: Windows 7\n# CVE: CVE-2021-24213\nExploitation requirements: Admin must visit payload URL. Default config.\nTested on: GiveWP 2.9.7, Wordpress 5.7, XAMPP 7.4.16, Firefox 86.0.1. Default configs on all products.\nVulnerable since: 2.4.0, Jan 16th 2019, commit 097c4d0ab964493776950381ed64498040395f6b\nActive Installations: 100,000+ per https://wordpress.org/plugins/give/\nResearcher: Austin Bentley (https://bentl.ee/)\nDetailed writeup available at httpS://bentl.ee/posts/cve-givewp/\n\nPoC URL:\nhttp://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors\n\nResponse:\n--- SNIP ---\n\">\n--- SNIP ---\nDisclosure Log:\n3/21/2021 -- Emailed GiveWP for security contact information\n3/22/2021 -- WPScan CNA issued CVE-2021-24213 (un-released)\n3/22/2021 -- Provided vendor with PoC\n3/22/2021 -- Vendor provided fix in 2.10.0\n3/23/2021 -- Fix validated, article posted, CVE unlocked\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:25.764075Z"}, {"uuid": "c72758ee-a856-4e3f-9a54-333ba66d30fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/2217", "content": "Exploit Collector\nWordPress GiveWP 2.9.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png \nWordPress GiveWP plugin version 2.9.7 suffers from a cross site scripting vulnerability.\n\nMD5 | e1d2d3f9920ae4f2a8d888e6f91a3b5e\n\nDownload\n# Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting\n# Date: 3/23/2021\n# Exploit Author: Austin Bentley\n# Vendor Homepage: https://givewp.com/\n# Software Link: https://wordpress.org/plugins/give/\n# Version: 2.9.7\n# Tested on: Windows 7\n# CVE: CVE-2021-24213\nExploitation requirements: Admin must visit payload URL. Default config.\nTested on: GiveWP 2.9.7, Wordpress 5.7, XAMPP 7.4.16, Firefox 86.0.1. Default configs on all products.\nVulnerable since: 2.4.0, Jan 16th 2019, commit 097c4d0ab964493776950381ed64498040395f6b\nActive Installations: 100,000+ per https://wordpress.org/plugins/give/\nResearcher: Austin Bentley (https://bentl.ee/)\nDetailed writeup available at httpS://bentl.ee/posts/cve-givewp/\n\nPoC URL:\nhttp://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors\n\nResponse:\n--- SNIP ---\n\">\n--- SNIP ---\nDisclosure Log:\n3/21/2021 -- Emailed GiveWP for security contact information\n3/22/2021 -- WPScan CNA issued CVE-2021-24213 (un-released)\n3/22/2021 -- Provided vendor with PoC\n3/22/2021 -- Vendor provided fix in 2.10.0\n3/23/2021 -- Fix validated, article posted, CVE unlocked\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T13:00:04.270169Z"}, {"uuid": "b1b40948-802a-4a2a-9572-fe74b62f618d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24213", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/2217", "content": "Exploit Collector\nWordPress GiveWP 2.9.7 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png \nWordPress GiveWP plugin version 2.9.7 suffers from a cross site scripting vulnerability.\n\nMD5 | e1d2d3f9920ae4f2a8d888e6f91a3b5e\n\nDownload\n# Exploit Title: GiveWP 2.9.7 Reflected Cross-Site Scripting\n# Date: 3/23/2021\n# Exploit Author: Austin Bentley\n# Vendor Homepage: https://givewp.com/\n# Software Link: https://wordpress.org/plugins/give/\n# Version: 2.9.7\n# Tested on: Windows 7\n# CVE: CVE-2021-24213\nExploitation requirements: Admin must visit payload URL. Default config.\nTested on: GiveWP 2.9.7, Wordpress 5.7, XAMPP 7.4.16, Firefox 86.0.1. Default configs on all products.\nVulnerable since: 2.4.0, Jan 16th 2019, commit 097c4d0ab964493776950381ed64498040395f6b\nActive Installations: 100,000+ per https://wordpress.org/plugins/give/\nResearcher: Austin Bentley (https://bentl.ee/)\nDetailed writeup available at httpS://bentl.ee/posts/cve-givewp/\n\nPoC URL:\nhttp://localhost/wp-admin/edit.php?s=%22%3E&start-date&end-date&form_id=0&action=-1&paged=1&give_action=delete_bulk_donor&orderby=id&order=DESC&action2=-1&post_type=give_forms&page=give-donors&view=donors\n\nResponse:\n--- SNIP ---\n\">\n--- SNIP ---\nDisclosure Log:\n3/21/2021 -- Emailed GiveWP for security contact information\n3/22/2021 -- WPScan CNA issued CVE-2021-24213 (un-released)\n3/22/2021 -- Provided vendor with PoC\n3/22/2021 -- Vendor provided fix in 2.10.0\n3/23/2021 -- Fix validated, article posted, CVE unlocked\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:29.348150Z"}]}