Stored Cross-Site Scripting in Philantro Donations Plugin for WordPress

CVE-2024-13527

What is CVE-2024-13527?

The Philantro Donations and Donor Management plugin for WordPress exhibits a vulnerability that allows stored cross-site scripting through the plugin's shortcodes like 'donate'. This issue exists across all versions up to and including 5.3, stemming from inadequate input sanitization and output escaping for user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this weakness to inject malicious scripts into pages. The injected scripts will execute whenever users visit the compromised pages, posing significant risks to website security and user safety.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References