CVE-2026-34900: GiveWP Cross-Site Scripting Vulnerability

CVE-2026-34900 Overview

CVE-2026-34900 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability affecting the GiveWP WordPress donation plugin in versions 4.14.2 and earlier. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and operates across a changed security scope, meaning injected scripts can affect components beyond the vulnerable plugin. Patchstack disclosed the issue against the GiveWP plugin, widely deployed on WordPress sites for donation processing.

Critical Impact
Attackers can hijack administrator sessions, steal donor data, or redirect users to attacker-controlled infrastructure by tricking site visitors or admins into clicking a crafted link.

Affected Products

GiveWP WordPress plugin versions <= 4.14.2
WordPress sites running the GiveWP donation plugin
Donation processing endpoints exposed by the plugin

Discovery Timeline

2026-06-15 - CVE-2026-34900 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34900

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the GiveWP plugin for WordPress. The plugin fails to properly sanitize or encode user-supplied input before reflecting it into HTTP responses. An attacker crafts a URL containing JavaScript payloads in vulnerable parameters and delivers it to a victim through phishing, social engineering, or embedded links on other sites. When the victim's browser loads the response, the injected script executes in the security context of the WordPress site.

Because the attack requires no authentication and triggers a scope change, the executed script can access cookies, session tokens, and Document Object Model (DOM) content belonging to the WordPress origin. Targeting administrators enables session theft and potential site takeover through the WordPress admin interface.

Root Cause

The root cause is missing or insufficient output encoding on a parameter reflected by GiveWP. The plugin echoes attacker-controlled input into HTML responses without applying WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> tags and event-handler attributes to render in the page.

Attack Vector

Exploitation occurs over the network and requires user interaction. The attacker delivers a crafted URL referencing the vulnerable GiveWP endpoint. When the victim visits the link, the injected payload is reflected and executed by the browser. See the Patchstack Vulnerability Report for the disclosure details.

Detection Methods for CVE-2026-34900

Indicators of Compromise

HTTP requests to GiveWP plugin endpoints containing <script>, javascript:, onerror=, or onload= substrings in query parameters
Outbound requests from administrator browsers to unknown domains shortly after visiting a GiveWP URL
Unexpected creation or modification of WordPress administrator accounts following an admin click event

Detection Strategies

Inspect web server access logs for GET requests to GiveWP routes containing URL-encoded HTML or JavaScript payloads such as %3Cscript%3E or %3Cimg
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns targeting WordPress plugin paths under /wp-content/plugins/give/
Correlate browser referrer headers with reports of suspicious GiveWP URLs distributed through email or social channels

Monitoring Recommendations

Enable WordPress audit logging to track administrator session activity and configuration changes
Monitor for sudden changes in GiveWP donation form behavior, including new outbound script references in rendered pages
Alert on HTTP 200 responses where request parameters contain HTML control characters reflected back in the response body

How to Mitigate CVE-2026-34900

Immediate Actions Required

Update the GiveWP plugin to a version newer than 4.14.2 as soon as a patched release is available from the vendor
Restrict access to WordPress administrator accounts and require multi-factor authentication for all privileged users
Review web server logs for prior exploitation attempts and rotate administrator credentials if suspicious activity is found

Patch Information

Consult the Patchstack Vulnerability Report for the current fixed version and remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files manually.

Workarounds

Deploy a WAF rule that strips or blocks HTML tags and JavaScript event handlers in query parameters destined for GiveWP endpoints
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on the WordPress site
Temporarily disable the GiveWP plugin on sites where donation functionality is not actively required until the patch is applied

bash

# Example nginx rule to block obvious XSS payloads targeting GiveWP
location ~* /wp-content/plugins/give/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}