Stored Cross-Site Scripting in GiveWP WordPress Plugin

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the GiveWP WordPress plugin affecting versions before 4.16.3. Users with the GiveWP Worker role or higher can inject malicious scripts into donation form template settings. The plugin fails to escape a donation-form template setting before outputting it in an HTML attribute, allowing arbitrary web scripts to execute when visitors view the public donation form.

Useful 0 Not Useful 0

Detection Guidance

Check if your GiveWP plugin version is below 4.16.3 by inspecting the plugin files or WordPress admin panel. Look for unauthorized changes to donation form template settings, particularly in the Submit Button label field. Review server logs for unusual script execution patterns on donation forms.

Useful 0 Not Useful 0

Impact Analysis

An attacker could inject malicious JavaScript code, such as an onfocus event, into a donation form. When visitors load the form, the injected script executes automatically, potentially stealing sensitive data, session cookies, or performing actions on behalf of the user without their knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or theft, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the GiveWP plugin to version 4.16.3 or later immediately. Remove or restrict access for users with the GiveWP Worker role until the update is applied. Audit donation forms for any suspicious script injections in template settings.

Useful 0 Not Useful 0