CVE-2024-27987: GiveWP Cross-Site Scripting Vulnerability

CVE-2024-27987 Overview

CVE-2024-27987 is a reflected Cross-Site Scripting (XSS) vulnerability in the StellarWP GiveWP plugin for WordPress. The flaw affects all GiveWP versions up to and including 3.3.1. It results from improper neutralization of input during web page generation, classified as [CWE-79].

Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser session when clicked. Because the vulnerability requires user interaction and delivers a scope change, it can affect authenticated administrators and site visitors alike. Successful exploitation may lead to session theft, credential harvesting, or unauthorized actions performed on behalf of the victim within the WordPress environment.

Critical Impact

A single crafted link can execute attacker-controlled JavaScript in a victim's browser, enabling session hijacking and unauthorized actions against WordPress donation sites running vulnerable GiveWP versions.

Affected Products

• StellarWP GiveWP plugin for WordPress, all versions up to and including 3.3.1
• WordPress installations with the GiveWP donation plugin enabled
• Sites processing donations through vulnerable GiveWP endpoints

Discovery Timeline

• 2024-03-15 - CVE-2024-27987 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27987

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the GiveWP WordPress donation plugin. Reflected XSS occurs when user-supplied input is returned in an HTTP response without proper sanitization or output encoding. An attacker delivers a crafted URL containing malicious payload parameters, and the vulnerable endpoint reflects that input into the rendered HTML.

The scope change indicated in the CVSS vector means the injected script executes in a security context different from the vulnerable component. In practice, this allows attacker-controlled JavaScript to interact with the WordPress admin interface, cookies, and Document Object Model (DOM) of the hosting site. Attackers commonly use such flaws to steal authenticated session cookies, pivot to administrator account takeover, or inject malicious donation forms that redirect payments.

GiveWP powers donation processing for nonprofit and fundraising websites, making these installations attractive targets for financially motivated attackers seeking to hijack donor traffic or exfiltrate donor personally identifiable information (PII).

Root Cause

The root cause is missing or insufficient input validation and output encoding within a GiveWP request handler. User-controlled parameters flow into rendered HTML output without being escaped through WordPress functions such as esc_html(), esc_attr(), or wp_kses(). This violates the CWE-79 principle of neutralizing input during web page generation.

Attack Vector

Exploitation requires an attacker to deliver a specially crafted URL to a target through phishing, forum posts, or malicious advertisements. When the victim clicks the link and their browser loads the vulnerable GiveWP page, the reflected payload executes in their session context. No prior authentication is required to craft the payload, but user interaction is mandatory. Refer to the Patchstack Vulnerability Advisory for the specific parameter details.

// No verified proof-of-concept code available.
// Refer to the Patchstack advisory for parameter-level exploitation details.

Detection Methods for CVE-2024-27987

Indicators of Compromise

• Web server access logs containing GiveWP request URIs with encoded <script>, javascript:, or onerror= payloads in query parameters
• Unusual outbound requests from browser sessions of WordPress administrators after visiting donation pages
• Unexpected creation of administrator accounts or modifications to GiveWP configuration following user visits to crafted URLs
• Referrer headers pointing to external phishing domains linking to your GiveWP endpoints

Detection Strategies

• Deploy Web Application Firewall (WAF) rules that inspect query strings for common XSS payload signatures targeting WordPress plugins
• Monitor GiveWP plugin version through WordPress site health checks and flag installations at or below version 3.3.1
• Correlate reflected parameter values in HTTP responses against known XSS payload patterns using proxy or WAF telemetry

Monitoring Recommendations

• Enable verbose WordPress and plugin logging to capture the full request URI and referrer for every GiveWP endpoint hit
• Forward web server logs to a centralized analytics platform for pattern detection across sessions and source IPs
• Alert on browser-side Content Security Policy (CSP) violations that indicate blocked inline script execution attempts

How to Mitigate CVE-2024-27987

Immediate Actions Required

• Update the GiveWP plugin to a version newer than 3.3.1 through the WordPress admin dashboard
• Audit administrator accounts and active sessions for signs of unauthorized access following the disclosure window
• Rotate WordPress administrator passwords and invalidate active sessions on sites running vulnerable GiveWP versions
• Review the Patchstack XSS Vulnerability Report for vendor remediation guidance

Patch Information

StellarWP addressed this vulnerability in a GiveWP release subsequent to 3.3.1. Administrators should upgrade to the latest available version through the WordPress plugin repository. Consult the Patchstack advisories linked above for the exact fixed version and changelog references.

Workarounds

• Disable the GiveWP plugin temporarily on sites that cannot immediately apply the update
• Deploy WAF rules that block requests containing script tags or JavaScript event handlers in GiveWP query parameters
• Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins
• Restrict access to WordPress administrative pages by source IP address until the plugin is patched

# Example Content-Security-Policy header to reduce reflected XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"