CVE-2024-10876: WordPress Charitable Plugin XSS Vulnerability

CVE-2024-10876 Overview

CVE-2024-10876 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Charitable – Donation Plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.3. It stems from unsafe use of add_query_arg and remove_query_arg without appropriate URL escaping in the donation list table administrative code. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. Successful exploitation requires user interaction and executes in the victim's browser context on the WordPress admin interface.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated administrator's browser session, enabling session theft, admin account takeover, or malicious content injection on WordPress sites running the vulnerable Charitable plugin.

Affected Products

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
All versions up to and including 1.8.3
WordPress sites using the vulnerable admin donation list table component

Discovery Timeline

2024-11-09 - CVE-2024-10876 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10876

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified as [CWE-79]. It resides in the plugin's admin-side donation list table located at includes/admin/donations/class-charitable-donation-list-table.php. The plugin passes user-controllable URL parameters through WordPress's add_query_arg() and remove_query_arg() functions without escaping the resulting URL before rendering it in the page. Because these functions return unsanitized query strings when supplied with attacker-controlled input from $_SERVER['REQUEST_URI'], the reflected value ends up in HTML output as an injection point. Exploitation requires tricking an authenticated user into clicking a malicious link. When the injected script executes, it runs with the privileges of the victim's WordPress session, which for administrator targets includes access to the site management interface.

Root Cause

The root cause is missing output escaping around the return values of add_query_arg and remove_query_arg. WordPress documentation explicitly warns that these functions do not sanitize their input and their output must be escaped with esc_url() before use in HTML attributes. The Charitable plugin failed to apply this escaping in the donation list table rendering path.

Attack Vector

The attack vector is network-based and requires user interaction. An unauthenticated attacker crafts a URL pointing to the vulnerable admin page with a malicious payload appended to the query string. When a logged-in WordPress user, typically an administrator viewing the donations list, clicks the link, the payload reflects into the DOM and executes. The resulting script can exfiltrate session cookies, perform actions on behalf of the admin via authenticated AJAX calls, or plant persistent backdoors through the WordPress admin interface.

See the WordPress Charitable Code File for the vulnerable source line and the WordPress Charitable Changeset for the applied fix.

Detection Methods for CVE-2024-10876

Indicators of Compromise

Unusual query string parameters containing HTML tags, javascript: URIs, or encoded <script> sequences targeting Charitable admin pages such as /wp-admin/admin.php?page=charitable-donations-table.
Referer headers in web server logs showing outbound clicks from email or messaging platforms that land on Charitable donation list URLs with suspicious query parameters.
Unexpected administrator account creation, plugin installation, or theme modification following an admin session that visited a crafted Charitable URL.

Detection Strategies

Inspect HTTP access logs for requests to Charitable admin endpoints containing URL-encoded script payloads, %3Cscript, onerror=, or onload= patterns in query parameters.
Deploy a Web Application Firewall (WAF) ruleset that flags reflected XSS payloads targeting /wp-admin/ paths owned by third-party plugins.
Query the installed plugin inventory across managed WordPress hosts to identify any Charitable installation at version 1.8.3 or earlier.

Monitoring Recommendations

Alert on newly created WordPress administrator accounts or role escalations without a corresponding change ticket.
Monitor outbound HTTP requests from web server processes to unknown external hosts, which may indicate script-driven exfiltration.
Track plugin and theme file modifications in wp-content/ using file integrity monitoring to catch post-exploitation persistence.

How to Mitigate CVE-2024-10876

Immediate Actions Required

Update the Charitable plugin to a version later than 1.8.3 that includes the fix referenced in changeset 3183944.
Audit recent WordPress administrator activity, focusing on account creation, plugin uploads, and modifications to theme files.
Force a password reset and session invalidation for all WordPress administrator accounts that accessed the donations admin area during the exposure window.

Patch Information

The vendor addressed the vulnerability in a Charitable plugin release following version 1.8.3. The fix wraps the return values of add_query_arg and remove_query_arg with esc_url() in the donation list table. Review the WordPress Charitable Changeset and the Wordfence Vulnerability Report for full remediation details.

Workarounds

Deactivate the Charitable plugin until the patched version can be installed if immediate updating is not possible.
Restrict access to /wp-admin/ paths by source IP address using web server or WAF rules to reduce the attack surface for reflected XSS delivery.
Enforce a strict Content Security Policy (CSP) on the WordPress admin interface to block inline script execution triggered by injected payloads.

bash

# Example nginx configuration to restrict wp-admin access by IP
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}

# Example Content-Security-Policy header for the admin interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;