Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T12:16:30.843Z",
  "pubdate": "2026-08-28T12:16:30.843Z",
  "executiveSummary": "The GiveWP – Donation Plugin and Fundraising Platform is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the 'give_form' shortcode, affecting all versions up to and including 4.14.4.\nThis security flaw occurs due to inadequate input sanitization and a failure to implement appropriate output escaping for the 'continue_button_title' and 'display_style' shortcode attributes.\nBy manipulating these attributes, an authenticated attacker with Contributor-level privileges or higher can inject malicious JavaScript payloads into WordPress pages.\nWhen a victim, including administrative users, accesses a page containing the compromised shortcode, the injected script executes within the context of the user's browser session.\nThis vulnerability presents a significant risk, as successful exploitation allows for unauthorized actions, session hijacking, or the theft of sensitive session cookies. Since the payload is stored persistently on the server, the impact extends to any user who visits the affected page, making this a high-severity security concern for WordPress administrators. Exploitation requires authenticated access to the platform, limiting the attack surface to users already permitted to edit content.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of user-supplied input within the 'give_form' shortcode processing logic. Specifically, the attributes 'continue_button_title' and 'display_style' are processed using 'sanitize_text_field()', which proves insufficient for preventing XSS when the resulting values are rendered within HTML context.\nThe flaw manifests because these sanitized values are subsequently embedded directly into HTML data attributes without secondary output escaping, such as 'esc_attr()'.\nAn attacker with Contributor-level access or higher can inject a crafted payload, such as '\" onmouseover=\"alert(document.cookie)\"', into these attributes. Because the application fails to neutralize these characters, the injected payload breaks out of the intended attribute context, allowing for the execution of arbitrary JavaScript.\nThe attack flow follows a predictable pattern: first, the authenticated attacker inserts the malicious 'give_form' shortcode into a post or page. Upon saving, the server stores the malicious attribute string in the database. When a user requests the page, the plugin renders the shortcode and writes the unsanitized input into the HTML document structure.\nThe browser interprets the malicious input as active code rather than mere attribute data. The execution occurs immediately or upon user interaction, depending on the payload structure. The vulnerability is persistent, as the payload remains in the database until manually removed or the plugin is patched.\nThe technical impact includes the potential for full account takeover if an administrator views the page, as the script can perform actions on behalf of the victim with the same privileges. Additionally, this facilitates unauthorized redirections, content modification, and information gathering by the attacker, effectively bypassing the security boundaries typically enforced by WordPress for lower-privileged users."
}