CVE-2026-104672: GiveWP XSS Vulnerability

CVE-2026-104672 Overview

CVE-2026-104672 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the GiveWP WordPress donation plugin in versions 4.17.0 and earlier. The flaw allows attackers to inject arbitrary JavaScript into pages rendered by the plugin without requiring authentication. Successful exploitation requires user interaction, typically through a crafted link or embedded request. The vulnerability is tracked under CWE-79 and carries a changed scope, meaning injected scripts can affect resources beyond the vulnerable component. GiveWP is widely deployed on nonprofit and fundraising sites, expanding the potential victim pool.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in the browsers of site visitors or administrators, enabling session theft, credential harvesting, and donation workflow manipulation.

Affected Products

• GiveWP WordPress plugin versions <= 4.17.0
• WordPress sites running the vulnerable give plugin
• Nonprofit and donation platforms built on GiveWP

Discovery Timeline

• 2026-10-06 - CVE-2026-104672 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104672

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of user-supplied input processed by the GiveWP plugin. An unauthenticated attacker crafts input containing JavaScript payloads that the plugin reflects or stores without encoding. When a victim interacts with the attacker-supplied link or page, the browser executes the payload in the context of the WordPress site.

Because the scope is changed, the injected script can access resources and data outside the vulnerable component boundary. Attackers can target site administrators to hijack sessions, pivot to higher-privileged actions, or modify donation forms to redirect funds. Visitors can be targeted for credential theft or malware delivery through drive-by techniques.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The GiveWP plugin fails to validate or encode specific request parameters before rendering them in HTML or JavaScript contexts. This absence of output encoding allows attacker-controlled strings to be interpreted as executable script.

Attack Vector

The attack is network-based and requires no authentication, but it does require user interaction. A typical exploitation chain involves the attacker distributing a crafted URL through phishing, forum posts, or social media. When a victim clicks the link, the GiveWP endpoint reflects the payload into the response, triggering script execution in the victim's browser. Refer to the Patchstack GiveWP Plugin XSS Vulnerability entry for additional technical context.

Detection Methods for CVE-2026-104672

Indicators of Compromise

• Web server access logs containing GiveWP endpoint requests with URL-encoded <script>, onerror=, onload=, or javascript: payloads
• Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting donation pages
• Modifications to GiveWP donation form configurations or redirect URLs made outside normal change windows

Detection Strategies

• Deploy a web application firewall (WAF) ruleset that flags reflected XSS patterns against /wp-content/plugins/give/ and give-prefixed query parameters
• Monitor WordPress audit logs for anomalous administrator session activity following clicks on external referrers
• Correlate browser Content Security Policy (CSP) violation reports with GiveWP page views to surface injection attempts

Monitoring Recommendations

• Enable verbose request logging for GiveWP endpoints and retain logs for at least 90 days for retrospective hunting
• Alert on administrator account activity originating from new IP addresses or user agents immediately after donation page interactions
• Track GiveWP plugin version across the estate and alert when any instance remains at 4.17.0 or earlier

How to Mitigate CVE-2026-104672

Immediate Actions Required

• Update GiveWP to a version later than 4.17.0 as soon as the patched release is available from the vendor
• Restrict administrative access to the WordPress dashboard using IP allowlists or VPN enforcement until patched
• Rotate administrator credentials and invalidate active sessions if XSS exploitation is suspected

Patch Information

Review the Patchstack GiveWP Plugin XSS Vulnerability advisory for the fixed version and vendor guidance. Apply the update across all WordPress sites running GiveWP and verify the plugin version after patching.

Workarounds

• Deploy a WAF rule to block requests containing script tags, event handlers, or javascript: schemes targeting GiveWP endpoints
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Temporarily disable the GiveWP plugin on sites where immediate patching is not feasible and donations can be paused

# Example CSP header to limit XSS impact in nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;