What’s Vulnerable › Vulnerabilities

CVE-2021-24298: Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-24 · updated 2026-06-17
• Weakness: CWE-79

Description

The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS

Affected products

• Igor Benic Simple Giveaways: before 2.36.2 — fixed in 2.36.2

How to fix

Upgrade to a fixed version: Igor Benic Simple Giveaways 2.36.2. Check the vendor advisory for mitigations.

References

• https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/
• https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91
• https://codevigilant.com/disclosure/2021/wp-plugin-giveasap-xss/
• https://wpscan.com/vulnerability/30aebded-3eb3-4dda-90b5-12de5e622c91

Get alerted when CVE-2021-24298 or the next vulnerability affects your stack