Stored XSS in GiveWP Donation Plugin for WordPress

Impact Analysis

An attacker with author-level access or higher can exploit this vulnerability to inject malicious scripts into pages via the 'block_id' shortcode attribute.

These injected scripts will execute in the browsers of users who visit the compromised pages, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious activities.

Because the vulnerability requires authenticated access at author level or above, the risk is somewhat limited to users with such privileges, but it still poses a significant threat to site integrity and user security.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the GiveWP – Donation Plugin and Fundraising Platform for WordPress, specifically in versions up to and including 4.16.0. It is a Stored Cross-Site Scripting (XSS) issue that occurs via the 'block_id' and other shortcode attributes of the 'givewp_campaign_comments' shortcode.

The root cause is insufficient input sanitization and output escaping in the functions CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(). The blockId value is directly inserted into a single-quoted HTML attribute without proper escaping (esc_attr()), allowing an attacker to inject arbitrary web scripts.

This vulnerability can be exploited by authenticated users with author-level access or higher, enabling them to inject malicious scripts that execute whenever a user views the affected page.

Useful 0 Not Useful 0