CVE-2026-104404 Overview
CVE-2026-104404 is a stored cross-site scripting (XSS) vulnerability in the GiveWP WordPress plugin, developed by Liquid Web / StellarWP. The flaw affects all versions of GiveWP up to and including 4.17.0. An authenticated attacker with low privileges can inject malicious scripts that execute in the browsers of other users who view affected pages. The vulnerability stems from improper neutralization of user input during web page generation [CWE-79]. Because the attack scope changes, injected payloads can impact components beyond the vulnerable plugin, including the broader WordPress administrative interface.
Critical Impact
Authenticated attackers can store JavaScript payloads that execute in administrator browsers, enabling session theft, account takeover, and unauthorized actions on behalf of privileged users.
Affected Products
- GiveWP WordPress plugin versions through 4.17.0
- Liquid Web / StellarWP distributions of GiveWP
- WordPress sites using GiveWP for donation management
Discovery Timeline
- 2026-10-05 - CVE CVE-2026-104404 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104404
Vulnerability Analysis
The vulnerability is a stored XSS flaw in GiveWP, a widely deployed WordPress donation plugin. The plugin fails to properly sanitize or encode user-supplied input before rendering it in web pages. Attackers with low-privilege authenticated access can submit crafted input containing JavaScript. The payload persists in the database and executes when other users, including administrators, visit affected pages.
The changed scope indicator means the injected script can access resources beyond the vulnerable component. In a WordPress context, this typically allows the payload to interact with the admin dashboard, perform privileged actions, or exfiltrate authentication cookies. User interaction is required for the payload to trigger.
Root Cause
The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. GiveWP accepts input through fields exposed to authenticated contributors or similar low-privilege roles and renders that input without applying context-appropriate output encoding or sanitization. Review the Patchstack XSS Vulnerability Advisory for component-level details.
Attack Vector
Exploitation requires network access and authenticated low-privilege credentials. The attacker submits a payload containing an HTML or JavaScript construct through a GiveWP input field. The payload is stored and later rendered to an administrator or another user. When the victim loads the page, the browser executes the attacker's script in the victim's security context. Possible outcomes include session hijacking, administrative action forgery, and redirection to attacker-controlled infrastructure.
Detection Methods for CVE-2026-104404
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript in GiveWP donation form fields, form metadata, or related post types
- Outbound requests from administrator browsers to unknown external domains following visits to GiveWP admin pages
- Unauthorized changes to WordPress user accounts, roles, or plugin configurations after admin sessions
- GiveWP plugin version at or below 4.17.0 present on WordPress installations
Detection Strategies
- Audit the WordPress wp_posts and GiveWP-specific database tables for stored HTML or script fragments in text fields
- Deploy web application firewall rules that flag XSS payload patterns submitted to GiveWP endpoints
- Review access logs for low-privilege accounts making unusual POST requests to donation-related URIs
Monitoring Recommendations
- Enable WordPress audit logging for content and settings changes performed through GiveWP
- Monitor administrator browser sessions for anomalous JavaScript execution or Document Object Model (DOM) modifications
- Alert on new or modified low-privilege WordPress accounts that interact with GiveWP forms
How to Mitigate CVE-2026-104404
Immediate Actions Required
- Identify all WordPress sites running GiveWP and inventory installed versions
- Upgrade GiveWP to a version released after 4.17.0 that includes the vendor fix
- Review existing GiveWP content and database entries for previously injected payloads and remove them
- Rotate credentials for administrators who accessed affected pages before patching
Patch Information
The vulnerability affects GiveWP through version 4.17.0. Site operators should apply the vendor-released update that addresses the stored XSS issue. Refer to the Patchstack XSS Vulnerability Advisory for the fixed version and vendor patch notes.
Workarounds
- Restrict low-privilege roles from accessing GiveWP input fields until the plugin is updated
- Deploy a web application firewall with XSS payload filtering in front of WordPress
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts in the WordPress admin interface
- Temporarily deactivate GiveWP on high-value sites if patching cannot be performed immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
