GiveWP Give Vulnerable to Reflected Cross-site Scripting

CVE-2024-27987

Summary

A vulnerability exists in GiveWP’s Give plugin, allowing for reflected cross-site scripting (XSS) attacks. This flaw arises from improper neutralization of input during the generation of web pages, potentially exposing users to malicious scripts. Attackers could exploit this vulnerability to execute arbitrary JavaScript in the context of a user's browser. Affected versions range from an unspecified version through 3.3.1, increasing risks for the users of these versions through the possibility of session hijacking, data theft, or redirection to malicious websites.

References