Description

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-30T13:17:32.760Z",
  "pubdate": "2026-09-30T13:17:32.760Z",
  "executiveSummary": "The GiveWP plugin, up to and including version 4.16.9, is vulnerable to an unauthenticated Cross-Site Scripting (XSS) flaw. This vulnerability allows an unauthenticated remote attacker to inject malicious client-side scripts into web pages viewed by other users, including administrators.\nThe vulnerability originates from improper neutralization of input prior to rendering, enabling the execution of arbitrary JavaScript within the context of the victim's session. The impact is significant, potentially leading to unauthorized actions, session hijacking, credential theft, or redirection to malicious sites.\nThis vulnerability is particularly severe because it does not require prior authentication, allowing any remote visitor to trigger the exploit. The risk implications include the potential for site takeover if an administrative user is tricked into interacting with a crafted URL or payload, leading to a complete compromise of the WordPress installation.",
  "technicalDetails": "The vulnerability resides in the improper handling of user-supplied input within the GiveWP plugin. Specifically, the application fails to adequately sanitize or escape data before reflecting it in the browser, which creates a classic reflected or stored Cross-Site Scripting (XSS) vector.\nIn versions 4.16.9 and earlier, the input processing functions used by GiveWP do not enforce strict content validation or output encoding. When an attacker crafts a malicious request containing script tags or event handlers, the plugin reflects this input back to the user's browser without appropriate neutralization.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies a vulnerable input parameter within the GiveWP plugin interface. The attacker then crafts a URL containing a malicious JavaScript payload encoded within this parameter. When a victim, such as a site administrator, interacts with the crafted link, the victim's browser executes the payload in the context of the origin site.\nBecause the payload executes within the victim's session context, the script gains access to sensitive data such as session cookies, CSRF tokens, and the Document Object Model (DOM) of the GiveWP administrative pages. The attacker can then utilize these privileges to perform unauthorized administrative actions, such as creating new user accounts, modifying plugin settings, or exfiltrating private donor data.\nThe root cause is a failure in the application's security architecture to implement context-aware output encoding. By failing to encode user-supplied input properly when rendering HTML, the application treats malicious string input as executable code. This is exacerbated by the lack of restrictive Content Security Policy (CSP) headers that would otherwise mitigate the execution of inline scripts.\nThe attack is performed over the network via standard HTTP/HTTPS requests. No special user privileges or authentication tokens are required to initiate the attack, as the flaw resides in publicly accessible components. The persistence of the impact depends on the specific injection point, but once successfully executed, the browser-side code can conduct automated post-exploitation tasks, such as 'phoning home' to a C2 (Command and Control) server with stolen session data."
}