Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-10-10T06:16:45.547Z",
  "pubdate": "2026-10-10T06:16:45.547Z",
  "executiveSummary": "The GiveWP – Donation Plugin and Fundraising Platform for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 4.17.0.\nThe vulnerability originates from improper handling of user-supplied input within the 'givewp_campaign_grid' shortcode attributes.\nAn authenticated attacker with Contributor-level access or higher can inject malicious JavaScript payloads that execute in the context of a victim's browser session when they view the compromised page.\nThis flaw enables unauthorized actions, session hijacking, or defacement by exploiting the trust relationship between the user and the WordPress environment.\nBecause the payload is stored persistently, the vulnerability impacts any user accessing the affected page, including administrators, which elevates the risk of complete site compromise.\nSuccessful exploitation requires the attacker to be able to create or edit posts or pages where the vulnerable shortcode can be embedded.",
  "technicalDetails": "The vulnerability is localized within the 'givewp_campaign_grid' shortcode implementation, specifically inside the 'CampaignGridShortcode::parseAttributes()' function. This function fails to adequately sanitize the 'filter_by', 'layout', 'sort_by', and 'order_by' attributes provided by the user within the shortcode block.\nThe primary root cause lies in a combination of insufficient input validation and insecure rendering logic. The plugin passes these user-supplied shortcode attributes into a 'json_encode()' function, which is subsequently rendered within a single-quoted HTML attribute in the plugin's template file.\nThe 'json_encode()' function in PHP does not, by default, escape single quotes ('). Consequently, an attacker can provide a payload containing a single quote to break out of the HTML attribute context. For instance, inputting an attribute value formatted as: ' onmouseover='alert(1) style='display:block', allows the attacker to terminate the intended attribute string prematurely and inject arbitrary HTML attributes, such as event handlers, that trigger JavaScript execution.\nThe exploitation flow begins with an authenticated user (Contributor or higher) inserting the maliciously crafted shortcode into a post or page. Once saved, the plugin stores these attributes in the database. When a visitor (or administrator) views the rendered page containing the shortcode, the server-side template outputs the unsanitized, serialized JSON blob into the HTML DOM.\nBecause the output is not passed through 'esc_attr()' or an equivalent sanitization function before being rendered inside the single-quoted attribute, the browser parses the injected event handlers. This results in the execution of arbitrary JavaScript in the victim's browser session.\nGiven that administrative users are common targets for viewing donation campaign pages, this vulnerability provides a vector for privilege escalation or administrative action manipulation. Post-exploitation, the malicious script can interact with the DOM to perform unauthorized requests, steal session cookies, or capture sensitive information transmitted during the user's session."
}