CVE-2025-7205: GiveWP WordPress Plugin XSS Vulnerability

CVE-2025-7205 Overview

CVE-2025-7205 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.5.0 and stems from insufficient input sanitization and output escaping in the donor notes parameter. Authenticated attackers with GiveWP worker-level access or higher can inject arbitrary JavaScript that executes when a user views an affected page. Exploitation requires tricking an administrator into visiting the legacy version of the site. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated low-privilege users can inject persistent JavaScript into donor records, enabling session theft, administrative action hijacking, and content manipulation when administrators access the legacy site view.

Affected Products

GiveWP – Donation Plugin and Fundraising Platform for WordPress
All versions up to and including 4.5.0
Installations exposing the legacy site view to administrators

Discovery Timeline

2025-07-31 - CVE-2025-7205 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7205

Vulnerability Analysis

The vulnerability resides in the GiveWP donor notes functionality exposed through the REST API endpoint handled by DonorNotesController.php. When a GiveWP worker or higher-privileged user submits a donor note, the plugin fails to sanitize script content on input and does not escape it when rendering the note in the legacy donor view. The injected payload is stored persistently in the WordPress database alongside the donor record.

An attacker with GiveWP worker-level access can place malicious JavaScript in a donor note that executes in the browser of any authenticated user who later views the affected page in the legacy interface. Because the attack crosses a trust boundary from a low-privilege contributor to an administrator session, it carries a scope change in its scoring. The resulting script runs under the administrator's origin and session, enabling actions such as account creation, settings modification, or arbitrary API calls on the victim's behalf.

Root Cause

The root cause is missing input sanitization and missing output escaping on the donor notes field. The DonorNotesController route accepted note content without stripping or neutralizing HTML and script tags, and the legacy template rendered that content directly into the DOM. See the vulnerable code path in the WordPress Give Plugin Code and the vendor fix in WordPress Give Changeset #3333090.

Attack Vector

Exploitation requires an authenticated session with at least GiveWP worker privileges. The attacker submits a donor note containing a JavaScript payload through the plugin's REST API or UI. The payload persists in the database. When an administrator visits the legacy donor view, the browser parses and executes the script in the administrator's authenticated context. Detailed technical context is available in the Wordfence Vulnerability Report.

No verified public exploit code is available. The vulnerability mechanism is described above in prose rather than reproducing a working payload.

Detection Methods for CVE-2025-7205

Indicators of Compromise

Donor note records containing <script> tags, onerror=, onload=, or javascript: URI schemes.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing donor pages.
Creation of new WordPress administrator accounts or modified user roles following donor note access.
REST API POST requests to /wp-json/give-api/v3/donors/*/notes originating from low-privilege accounts.

Detection Strategies

Query the WordPress database for donor note content matching HTML or JavaScript patterns to surface stored payloads.
Review web server access logs for POST requests to the GiveWP donor notes REST endpoint from non-administrator sessions.
Monitor WordPress audit logs for GiveWP worker accounts creating or modifying donor notes at unusual rates.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record donor note creation events with user attribution.
Alert on administrator sessions that trigger script-driven account changes shortly after accessing donor pages.
Track plugin version inventory across all WordPress sites to confirm GiveWP installations above 4.5.0.

How to Mitigate CVE-2025-7205

Immediate Actions Required

Update GiveWP to the patched release immediately above version 4.5.0 on all WordPress sites.
Audit all GiveWP worker, manager, and accountant accounts and remove unneeded privileges.
Inspect existing donor notes for malicious HTML or script content and sanitize or delete affected records.
Instruct administrators to avoid the legacy donor view until patching is complete.

Patch Information

The vendor addressed the issue in the commit documented by WordPress Give Changeset #3333090, which adds input sanitization and output escaping in DonorNotesController.php. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release.

Workarounds

Restrict GiveWP worker-level and higher roles to trusted personnel only until the patch is applied.
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags in donor note fields.
Disable or hide the legacy GiveWP donor view in administrator workflows.
Enforce a Content Security Policy (CSP) that forbids inline script execution within the WordPress admin interface.

bash

# Example WP-CLI commands to verify plugin version and audit roles
wp plugin get give --field=version
wp user list --role=give_worker --fields=ID,user_login,user_email