First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2019-15317

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The give plugin before 2.4.7 for WordPress has XSS via a donor name.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.sucuri.net/2019/05/wordpress-plugin-give-stored-xss-for-donors.htmlExploit, Third Party Advisory
https://wordpress.org/plugins/give/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9584Third Party Advisory
https://blog.sucuri.net/2019/05/wordpress-plugin-give-stored-xss-for-donors.htmlExploit, Third Party Advisory
https://wordpress.org/plugins/give/#developersRelease Notes
https://wpvulndb.com/vulnerabilities/9584Third Party Advisory

Timeline

Published: Aug 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-153189.8The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.CVE-2019-153199.8The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-153209.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-153219.8The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-153229.8The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-153237.5The ad-inserter plugin before 2.4.20 for WordPress has path traversal.CVE-2019-153248.8The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.CVE-2019-153257.5In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/ptrace_scope to 1, wh CVE-2019-153267.5The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-153276.1The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-153286.1The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-153298.8The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.