CVE-2024-13690 Overview
CVE-2024-13690 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Church Donation plugin for WordPress. The flaw affects all versions up to and including 1.7. Unauthenticated attackers can inject arbitrary JavaScript through several donation form submission parameters because the plugin fails to sanitize input or escape output. Injected scripts execute in the browser of any user who views an affected page, including administrators reviewing donation listings.
The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation and resides in the donation form display and listings components of the plugin.
Critical Impact
Unauthenticated attackers can persistently store malicious JavaScript through donation form fields, leading to session hijacking, administrative account takeover, and arbitrary client-side actions when staff review submissions.
Affected Products
- WordPress plugin: WP Church Donation, versions through 1.7
- Vulnerable files: includes/church-donation-form-display.php and includes/church-donation-listings.php
- WordPress sites running the plugin without additional input filtering
Discovery Timeline
- 2025-03-25 - CVE-2024-13690 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-13690
Vulnerability Analysis
The WP Church Donation plugin accepts donor input through multiple donation form submission parameters and stores those values in the WordPress database. When administrators or visitors render donation listings, the plugin echoes those values back into the HTML response without applying proper escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). This allows an attacker to embed HTML and JavaScript that executes in the context of the WordPress site.
Because the donation form is exposed to unauthenticated users by design, no credentials, tokens, or social engineering steps are required to deliver the payload. The script executes whenever a victim loads a page containing the injected content, including the WordPress admin dashboard area where donation submissions are reviewed.
Root Cause
The root cause is insufficient input sanitization on write and missing output escaping on render. Donation parameters submitted through the form display logic in church-donation-form-display.php are persisted without filtering for HTML control characters. The listings logic in church-donation-listings.php then concatenates those raw values into HTML output, satisfying the conditions for stored XSS classified under CWE-79.
Attack Vector
An attacker submits a crafted donation form where one or more fields contain a JavaScript payload such as a <script> tag or an event handler attached to an HTML element. The plugin stores the value verbatim. When an administrator opens the donation listings page or any front-end page rendering the data, the browser parses and executes the attacker-controlled script under the site's origin. Resulting actions include cookie theft, forced administrative requests via the WordPress REST API, content defacement, and redirection to attacker-controlled infrastructure.
Detection Methods for CVE-2024-13690
Indicators of Compromise
- Donation database records containing <script>, onerror=, onload=, or javascript: substrings in fields such as donor name, message, or address.
- Outbound requests from administrator browsers to unfamiliar domains shortly after viewing donation listings.
- Unexpected administrative actions, new admin users, or modified plugin and theme files following access to the donation listings page.
- Anomalous entries in wp_options or new scheduled tasks created from the WordPress admin session.
Detection Strategies
- Inspect donation records and post meta entries written by the plugin for HTML tags and JavaScript event handlers.
- Enable WordPress debug logging and review web server access logs for POST requests to donation endpoints containing encoded <script> patterns.
- Deploy a Content Security Policy (CSP) in report-only mode to capture inline script execution on pages rendered by the plugin.
Monitoring Recommendations
- Monitor administrative sessions for script-triggered REST API calls to /wp-json/wp/v2/users and /wp-json/wp/v2/plugins.
- Alert on creation of new administrator accounts or changes to user roles after a donation listing page view.
- Track file integrity for WordPress core, plugin, and theme files to detect post-exploitation modifications.
How to Mitigate CVE-2024-13690
Immediate Actions Required
- Deactivate and remove the WP Church Donation plugin until a patched release is published and verified.
- Audit existing donation submissions in the database and purge or sanitize records containing HTML or script content.
- Rotate WordPress administrator passwords and invalidate active sessions for any user who accessed donation listings.
- Review installed plugins, themes, and administrator accounts for unauthorized modifications.
Patch Information
No fixed version is referenced in the public advisory at the time of this writing. Consult the Wordfence Vulnerability Report and the WordPress Plugin Page for updates. Apply any release greater than 1.7 that explicitly documents fixes for stored XSS in the donation form display and listings components.
Workarounds
- Restrict access to the donation form using a Web Application Firewall (WAF) rule that blocks request bodies containing <script, onerror=, or javascript: patterns.
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
- Limit administrative dashboard access to trusted IP addresses while the plugin remains installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
