CVE-2024-1424 in GiveWP Plugin
Summary
by MITRE • 04/09/2024
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The vulnerability identified as CVE-2024-1424 affects the GiveWP – Donation Plugin and Fundraising Platform WordPress plugin, presenting a critical stored cross-site scripting vulnerability that impacts versions up to and including 3.5.1. This security flaw resides within the plugin's shortcode implementation where user-supplied attributes are not adequately sanitized or properly escaped before being rendered in web pages. The vulnerability specifically targets authenticated attackers who possess contributor-level permissions or higher, making it particularly concerning as it allows these users to execute malicious scripts against other users who access compromised pages.
The technical exploitation of this vulnerability stems from insufficient input validation mechanisms within the plugin's shortcode processing functions. When administrators or contributors create or modify donation forms using the plugin's shortcodes, they can inject malicious script code through attribute parameters that are not properly filtered or escaped. This stored XSS vulnerability operates by persistently embedding malicious scripts within the plugin's shortcode attributes, which are then executed whenever any user accesses pages containing these compromised shortcodes. The vulnerability aligns with CWE-79, which defines Cross-Site Scripting as a weakness where untrusted data is incorporated into web pages without proper validation or escaping, allowing attackers to execute scripts in the victim's browser context.
The operational impact of this vulnerability extends beyond simple script execution as it provides attackers with persistent access to compromised WordPress installations. Contributors with access to the plugin's shortcode functionality can inject malicious code that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or further exploitation of the WordPress environment. The attack vector is particularly dangerous because it requires minimal privileges and can be executed through legitimate plugin functionality, making it difficult to detect through standard security monitoring. This vulnerability can be leveraged to escalate privileges, compromise user sessions, or redirect users to malicious sites, all while remaining hidden within normal plugin usage patterns.
Mitigation strategies for CVE-2024-1424 should prioritize immediate plugin updates to versions that address the sanitization and escaping deficiencies in the shortcode processing functions. Organizations should implement strict access controls to limit contributor-level permissions to trusted individuals only, as this vulnerability requires at least contributor-level access to exploit effectively. Security monitoring should include regular scanning of shortcode attributes for suspicious patterns and implementation of Content Security Policy headers to limit script execution capabilities. The vulnerability demonstrates the importance of proper input sanitization and output escaping as outlined in the OWASP Top Ten and ATT&CK framework's T1566 technique for Phishing, where attackers leverage web application vulnerabilities to execute malicious code against unsuspecting users. Additionally, administrators should conduct regular security audits of plugin configurations and implement web application firewalls to detect and prevent exploitation attempts targeting this specific vulnerability pattern.