CVE-2024-35679: GiveWP Cross-Site Scripting Vulnerability

CVE-2024-35679 Overview

CVE-2024-35679 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the StellarWP GiveWP WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation. It affects all versions of GiveWP up to and including 3.12.0. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session within the context of the vulnerable WordPress site.

GiveWP is a widely deployed donation and fundraising plugin for WordPress, expanding the attack surface across nonprofit and charity websites.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and administrative action abuse when a privileged user is tricked into interacting with a crafted URL.

Affected Products

StellarWP GiveWP plugin for WordPress, versions up to and including 3.12.0
WordPress sites running GiveWP donation forms
Any deployment inheriting the vulnerable GiveWP release before the vendor patch

Discovery Timeline

2024-06-08 - CVE-2024-35679 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35679

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the GiveWP plugin. User-controlled input is reflected back into an HTTP response without proper output encoding or sanitization. When a victim loads the crafted URL, the browser parses attacker-supplied payload as executable script.

Because the scope is changed per the CVSS vector, code executes in the security context of the WordPress site. Attackers can read Document Object Model (DOM) content, exfiltrate cookies not marked HttpOnly, and perform authenticated actions on behalf of a logged-in administrator. User interaction is required, which typically means clicking a link delivered through phishing, social media, or a compromised referrer.

Root Cause

The root cause is missing or insufficient sanitization of request parameters before echoing them into HTML output. The plugin does not apply WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses() to at least one reflected parameter path in versions up to 3.12.0. Refer to the Patchstack XSS Vulnerability Advisory for the affected parameter details.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker crafts a URL to the vulnerable GiveWP endpoint containing a JavaScript payload in a request parameter. The victim must click the link or otherwise load it. Upon rendering, the reflected payload executes in the victim's browser. Site administrators are the primary target, since script execution in an admin session enables account takeover and plugin or user manipulation.

No verified proof-of-concept code is available in the referenced advisories. See the Patchstack GiveWP Plugin XSS Details for further technical context.

Detection Methods for CVE-2024-35679

Indicators of Compromise

HTTP requests to GiveWP endpoints containing script tags, javascript: URIs, or event handlers such as onerror= and onload= in query parameters
Web server access logs showing URL-encoded payloads (%3Cscript%3E, %3Cimg) directed at donation form URLs
Outbound browser requests from administrator sessions to unfamiliar domains shortly after visiting a GiveWP URL
Unexpected WordPress admin actions (user creation, plugin installation) correlated with a preceding suspicious link click

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings on GiveWP paths for XSS signatures
Correlate WordPress wp-admin audit events with referrer URLs pointing to reflected GiveWP endpoints
Alert on GiveWP plugin versions at or below 3.12.0 discovered during asset inventory scans

Monitoring Recommendations

Enable verbose HTTP access logging on the WordPress reverse proxy and retain logs for retrospective hunting
Monitor for Content Security Policy (CSP) violation reports if a report-only or enforcing CSP is deployed
Track outbound DNS from administrator workstations for callbacks to attacker-controlled domains

How to Mitigate CVE-2024-35679

Immediate Actions Required

Upgrade GiveWP to a version later than 3.12.0 that includes the vendor fix
Audit WordPress administrator accounts for unauthorized changes since the plugin was installed
Rotate administrator session cookies and enforce reauthentication for privileged users
Apply a virtual patch via WAF if immediate upgrade is not feasible

Patch Information

StellarWP has released fixed versions of GiveWP addressing the reflected XSS issue. Consult the Patchstack XSS Vulnerability Advisory for the exact remediated version and update GiveWP through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict wp-admin access to trusted IP ranges at the reverse proxy or firewall
Enforce a strict Content Security Policy that disallows inline script execution
Set the HttpOnly and Secure flags on WordPress authentication cookies to reduce cookie theft impact
Train administrators to avoid clicking untrusted links to the WordPress site

bash

# Update GiveWP via WP-CLI on the affected WordPress host
wp plugin update give
wp plugin get give --field=version