Description

Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:17:13.280Z",
  "pubdate": "2026-08-13T14:17:13.280Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the donor functionality of the GiveWP plugin affecting versions prior to 4.16.6. This security flaw allows malicious actors to inject and execute arbitrary client-side scripts, typically JavaScript, within the context of a victim's browser session. The vulnerability impacts the GiveWP WordPress plugin ecosystem, posing significant risk implications such as session hijacking, credential theft, defacement, and unauthorized actions performed on behalf of authenticated users.\nThe attacker capabilities include the ability to craft malicious payloads targeting administrative or privileged users who interact with affected donor records or data interfaces. Exploitation requirements generally involve tricking a user into viewing the maliciously crafted data or interacting with a compromised endpoint within the application. Successful exploitation compromises the integrity and confidentiality of the web application session, potentially leading to full administrative compromise depending on the privileges of the targeted user.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and output encoding within the donor data handling components of the GiveWP plugin. Specifically, user-supplied data collected during the donation process or associated with donor profiles is insufficiently validated before being reflected back to users within the administrative dashboard or front-end interfaces. This missing context-aware output encoding allows malicious HTML or JavaScript payloads to be stored or reflected persistently or non-persistently within the Document Object Model (DOM).\nThe vulnerable component resides in the donor management and reporting modules of GiveWP versions prior to 4.16.6. Network exposure is broad, as donation forms and administrative interfaces are typically accessible over standard HTTP/HTTPS protocols. Depending on the exact injection vector, authentication requirements may vary, though stored XSS vectors often require low-privilege access to submit malicious input via donation vectors, followed by high-privilege administrative interaction to trigger the payload execution.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious payload containing JavaScript and inputs it into a donation parameter or field processed by GiveWP. The application accepts this input without proper sanitization and stores it within the database or echoes it directly into the HTTP response. Second, an unsuspecting administrator or privileged user navigates to the affected donor management page within the WordPress dashboard. Third, the browser renders the response, executing the malicious payload within the trusted context of the victim's session. The payload behavior can range from executing arbitrary API requests to exfiltrating session cookies, stealing sensitive data, or performing unauthorized administrative actions such as creating malicious administrator accounts. Post-exploitation impact includes complete session compromise and potential escalation of privileges within the WordPress environment."
}