CVE-2025-13206: GiveWP Donation Plugin XSS Vulnerability

CVE-2025-13206 Overview

CVE-2025-13206 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.13.0. It stems from insufficient input sanitization and output escaping on the name parameter used during donation processing. Unauthenticated attackers can inject arbitrary JavaScript that executes when any user views a page containing the injected content. Exploitation requires the WordPress installation to have avatars enabled, which is a common default configuration on donation and community sites.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into donation-related pages, enabling session hijacking, credential theft, and administrative account takeover through victim-initiated page loads.

Affected Products

GiveWP – Donation Plugin and Fundraising Platform for WordPress, all versions through 4.13.0
WordPress sites using GiveWP with avatars enabled
Donor Wall shortcode and donation processing components (class-give-donor.php, process-donation.php, shortcode-donor-wall.php)

Discovery Timeline

2025-11-19 - CVE-2025-13206 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13206

Vulnerability Analysis

The vulnerability resides in how GiveWP handles donor name input during the donation submission workflow. Attackers submit a donation and place JavaScript payloads in the name field. The plugin stores the value without adequate sanitization and later renders it without proper output escaping. When avatars are enabled, donor names are output in avatar-related HTML contexts that execute the injected script. Because the injection is stored, every visitor loading the affected page triggers the payload, including administrators viewing donation dashboards or public visitors browsing the Donor Wall.

Root Cause

The root cause is missing input sanitization and output escaping on the name parameter across three code paths: donor record creation in class-give-donor.php (line 1135), donation processing in process-donation.php (line 1230), and rendering in templates/shortcode-donor-wall.php (line 59). WordPress provides functions such as sanitize_text_field() and esc_html() for these contexts, but the affected code paths did not apply them consistently to donor-supplied name data.

Attack Vector

The attack requires no authentication. An attacker initiates a donation flow, supplies a crafted name value containing a script payload, and completes submission. The malicious donor record persists in the database. Any subsequent page load that renders the donor name — including the Donor Wall shortcode and donor listings — executes the payload in the visitor's browser under the site's origin. User interaction is limited to viewing the affected page. Refer to the Wordfence Vulnerability Report and the WordPress Changeset #3398128 for the specific code paths and patch.

Detection Methods for CVE-2025-13206

Indicators of Compromise

Donor records containing HTML tags, <script>, onerror=, onload=, or javascript: sequences in the donor name field.
Unexpected outbound requests from browsers viewing donation pages, particularly to attacker-controlled domains.
New or modified WordPress administrator accounts created shortly after a visitor session on a donation page.

Detection Strategies

Query the wp_give_donors and wp_usermeta tables for donor names matching regex patterns such as <[a-z]+|on[a-z]+=|javascript:.
Inspect web server logs for POST requests to donation endpoints containing URL-encoded angle brackets or common XSS payload fragments in the name parameter.
Correlate donation form submissions with subsequent anomalous administrator activity, session token reuse, or password resets.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations on donation-related pages.
Alert on any donation payload where name field length exceeds typical donor name lengths or contains non-alphabetic tokens.
Monitor plugin file integrity and confirm the installed GiveWP version through automated WordPress inventory checks.

How to Mitigate CVE-2025-13206

Immediate Actions Required

Update GiveWP to a version later than 4.13.0 that includes the fix from WordPress Changeset #3398128.
Audit existing donor records for stored payloads and sanitize or remove any donor names containing HTML or script content.
Rotate WordPress administrator credentials and invalidate active sessions if evidence of exploitation is found.

Patch Information

The vendor released a fix tracked as WordPress Changeset #3398128, which applies sanitization and escaping to donor name handling. Site operators should update through the WordPress plugin manager or replace the plugin files with the patched release. Verify the installed version matches or exceeds the patched release after deployment.

Workarounds

Disable avatars in WordPress settings until the plugin is updated, since exploitation requires avatars to be enabled.
Remove or unpublish the [give_donor_wall] shortcode from public-facing pages to reduce exposure to stored payload execution.
Deploy a Web Application Firewall (WAF) rule that blocks donation submissions containing HTML tags or JavaScript scheme handlers in the name parameter.

bash

# Example WAF rule (ModSecurity) blocking script content in the GiveWP name parameter
SecRule ARGS:give-first|ARGS:give-last|ARGS:name "@rx (?i)(<script|javascript:|on[a-z]+\s*=)" \
    "id:1013206,phase:2,deny,status:403,log,msg:'Potential CVE-2025-13206 XSS payload in GiveWP name field'"