CVE-2026-13704 Overview
CVE-2026-13704 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.16.1. The plugin fails to properly sanitize input and escape output for the sequoia[introduction][image] parameter. Authenticated users with Give Worker-level access or higher can inject arbitrary web scripts. Those scripts execute in the browser of any user who views the affected page.
Critical Impact
Authenticated Give Worker users can persist malicious JavaScript into donation form pages, enabling session hijacking, credential theft, and administrative account takeover when higher-privileged users view the injected content.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All plugin versions up to and including 4.16.1
- WordPress sites using the Sequoia form template
Discovery Timeline
- 2026-07-02 - CVE-2026-13704 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13704
Vulnerability Analysis
The vulnerability resides in the GiveWP plugin's Sequoia form template. The plugin accepts user-supplied data through the sequoia[introduction][image] parameter but does not adequately sanitize the value on input or escape it on output. When the introduction section of a Sequoia donation form is rendered, the tainted value is written directly into the HTML response.
The rendering path traverses src/Views/Form/Templates/Sequoia/Sequoia.php and src/Views/Form/Templates/Sequoia/sections/introduction.php, where the image parameter is emitted into the page markup. Because the value is stored server-side, the injection persists across sessions and affects every visitor to the donation form until it is removed.
Root Cause
The root cause is insufficient input sanitization in the form metadata handler at includes/admin/forms/class-metabox-form-data.php combined with missing output escaping when the Sequoia template renders the introduction image. Neither esc_attr() nor equivalent context-aware escaping is applied before the value is inserted into the DOM. This allows HTML and JavaScript payloads supplied by a Give Worker to survive the save-and-render cycle intact.
Attack Vector
Exploitation requires an authenticated account with Give Worker-level permissions or higher. The attacker edits a donation form using the Sequoia template and supplies a malicious payload in the introduction image field. When any user, including administrators, visits the affected form or backend page, the injected script executes with that user's session context. The changed scope (S:C) in the CVSS vector reflects that impact crosses the trust boundary between the low-privileged contributor and higher-privileged viewers.
No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-13704
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in GiveWP form metadata for the Sequoia template.
- Outbound requests from browser sessions of WordPress administrators to unfamiliar domains shortly after visiting a donation form edit page.
- New or modified WordPress administrator accounts created shortly after a Give Worker account was active.
Detection Strategies
- Audit the wp_postmeta table for GiveWP form entries containing sequoia[introduction][image] values with HTML tags or JavaScript syntax.
- Review WordPress access logs for POST requests to admin.php and post.php from Give Worker accounts modifying donation forms.
- Deploy a web application firewall rule that flags script-like payloads submitted to GiveWP form save endpoints.
Monitoring Recommendations
- Monitor changes to donation form metadata and alert on additions containing angle brackets or event handler attributes.
- Track authentication and privilege usage for all Give Worker and higher accounts, correlating form edits with subsequent admin session activity.
- Enable Content Security Policy (CSP) reporting to identify unexpected inline script execution on donation pages.
How to Mitigate CVE-2026-13704
Immediate Actions Required
- Update the GiveWP plugin to a version later than 4.16.1 once the vendor releases a patched release.
- Audit all Give Worker and higher accounts, removing unnecessary access and rotating credentials for retained users.
- Inspect existing Sequoia donation forms for injected payloads in the introduction image field and sanitize any tainted entries.
Patch Information
At the time of publication, the vulnerable code paths remain present in versions 4.14.6 and 4.16.0, as documented in the WordPress plugin source. Administrators should monitor the GiveWP changelog and apply the fixed release once available. Refer to the Wordfence advisory for patch status updates.
Workarounds
- Restrict the Give Worker role and higher privileges to trusted administrators only until a patch is applied.
- Disable the Sequoia form template and switch donation forms to an unaffected template where feasible.
- Deploy a WAF signature to block script tags and event handlers submitted to GiveWP form endpoints as a compensating control.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
