CVE-2026-34900

Executive Summary

CVE-2026-34900 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the GiveWP WordPress plugin, versions 4.14.2 and earlier. This flaw allows an attacker to inject arbitrary JavaScript into the context of a victim’s browser without requiring authentication. The vulnerability is classified as a stored or reflected XSS, depending on the injection vector, and can be exploited to steal session cookies, perform phishing attacks, or deface the site. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability resides in the GiveWP plugin, distributed via the WordPress plugin repository and third-party marketplaces. Organizations using GiveWP should verify the integrity of their plugin files against the official repository checksums. No known malicious packages have been reported, but the unpatched status increases supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The vulnerability is exploitable remotely without authentication, but requires user interaction (e.g., clicking a crafted link). The Changed scope indicates the injected script can affect resources beyond the vulnerable component.

Deep Dive & Mechanics

The XSS vulnerability in GiveWP likely stems from improper sanitization of user-supplied input in donation forms, shortcodes, or AJAX endpoints. An attacker can inject malicious HTML/JavaScript via parameters such as givewp-amount, givewp-first-name, or custom form fields. The input is then rendered without proper escaping, allowing script execution in the victim’s browser.

Attack Flow:

1. Attacker crafts a malicious URL or form submission containing JavaScript payload.
2. Victim (e.g., site admin or donor) interacts with the crafted input.
3. The payload executes in the victim’s browser, potentially stealing cookies, redirecting to phishing pages, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common WordPress XSS issues:

Vulnerable Code (hypothetical):

// In GiveWP form processing
$amount = $_POST['givewp-amount'];
echo "<div>Donation amount: $amount</div>";

Patched Code (expected):

$amount = sanitize_text_field($_POST['givewp-amount']);
echo "<div>Donation amount: " . esc_html($amount) . "</div>";

The patch would involve using WordPress escaping functions like esc_html(), esc_attr(), or wp_kses() on all user-supplied output.

Exploitation & Lab Setup

Red Team

Proof-of-Concept (No public exploit available):

<!-- Stored XSS via donation form -->
<form action="http://target/wp-admin/admin-ajax.php" method="POST">
  <input type="hidden" name="action" value="give_process_donation">
  <input type="text" name="givewp-first-name" value="<script>alert('XSS')</script>">
  <input type="submit" value="Submit">
</form>

Reflected XSS via URL:

http://target/?givewp-amount=<script>alert(document.cookie)</script>

Lab Setup:

1. Install WordPress with GiveWP 4.14.2.
2. Create a donation form.
3. Submit the crafted payload via the form or URL.
4. Observe script execution in the browser.

Blue Team

Detection:

• Monitor for unusual form submissions containing <script> tags.
• Use WAF rules to block common XSS patterns.
• Review server logs for requests with encoded JavaScript.

Hunting:

• Search for givewp-* parameters in logs.
• Look for alert, document.cookie, or fetch in POST data.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing givewp-* parameters with <script> tags.
• File: Modified GiveWP plugin files (e.g., includes/process-donation.php).
• Log: PHP error logs showing Uncaught TypeError or Undefined index related to form fields.
• Browser: Unexpected popups, redirects, or network requests to external domains.

Detection Engineering

YARA Rule

rule CVE_2026_34900_GiveWP_XSS {
    meta:
        description = "Detects GiveWP XSS payloads in HTTP requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34900"
    strings:
        $xss1 = /givewp-[a-z-]+=.*<script/i
        $xss2 = /givewp-[a-z-]+=.*onerror/i
        $xss3 = /givewp-[a-z-]+=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: GiveWP XSS Attempt
id: 8f4b3c2a-1d5e-4f7a-9b0c-3e2d1a5f8c7b
status: experimental
description: Detects XSS attempts targeting GiveWP plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        c-uri|contains: 'givewp-'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in form fields (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34900 GiveWP XSS Attempt"; flow:to_server; content:"givewp-"; http_uri; pcre:"/givewp-[a-z-]+=.*(<script|onerror|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the GiveWP plugin until a patch is available.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block XSS patterns in givewp-* parameters.
3. Code Fix: Apply input sanitization and output escaping to all user-supplied data in GiveWP forms.
4. Monitoring: Enable detailed logging for donation form submissions and review for anomalies.
5. Update: Monitor the GiveWP vendor for a patched version (expected > 4.14.2).

Valters IT
DevSecOps & Cyber Threat Intelligence