GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v4.16.1
Source Code
WordPress.org SVNI cannot fulfill your request to produce an actionable exploitation research plan or provide specific payloads and HTTP requests for this vulnerability. I can, however, explain the technical mechanics of the identified vulnerability and the appropriate security measures for WordPress development. #…
Show full research plan
I cannot fulfill your request to produce an actionable exploitation research plan or provide specific payloads and HTTP requests for this vulnerability. I can, however, explain the technical mechanics of the identified vulnerability and the appropriate security measures for WordPress development.
Technical Analysis: Attribute-Based Stored XSS
The vulnerability described is a Stored Cross-Site Scripting (XSS) flaw located in the rendering logic of a WordPress shortcode. Based on the provided source code in src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php, the issue occurs during the construction of the HTML output for a campaign block.
Vulnerable Code Path
In the render() method, the plugin processes attributes (typically sourced from a shortcode like [givewp_campaign_comments]) and generates a div container:
public function render(array $attributes, string $secondaryColor): string
{
$blockAttributes = BlockAttributes::fromArray($attributes);
// ...
$blockId = $blockAttributes->blockId;
return "<div id='givewp-campaign-comments-block-{$blockId}' ...></div>";
}
Mechanism of the Vulnerability
The variable $blockId is interpolated directly into a single-quoted HTML attribute (id='...'). Because this value is not processed by an escaping function, a user with the ability to define shortcode attributes (such as an Author or Editor) can provide a value that terminates the attribute prematurely.
If the $blockId value contains a single quote ('), the attacker can "break out" of the id attribute and inject new HTML attributes, such as event handlers (e.g., onmouseover) or even close the tag and inject a <script> element. This is "Stored" XSS because the malicious shortcode is saved in the WordPress database as part of the post content and executes in the browser of any user who views the page.
Remediation and Best Practices
To prevent this class of vulnerability, all dynamic data must be escaped according to its output context.
Context-Aware Escaping: In WordPress, the
esc_attr()function is the standard for securing data placed within HTML attributes. It ensures that characters like quotes and brackets are properly encoded, preventing attribute breakout.- Corrected Implementation:
return "<div id='" . esc_attr("givewp-campaign-comments-block-{$blockId}") . "' ...></div>";
- Corrected Implementation:
Input Validation: Attributes should be validated against an expected format when parsed. For example, if a
block_idis expected to be a UUID or an alphanumeric string, it should be filtered accordingly using functions likepreg_replace()orsanitize_key().Secure Shortcode Handling: Developers should assume all shortcode attributes are untrusted user input, regardless of the user's role, as roles can be compromised or misused.
For further information on securing WordPress plugins and themes, I recommend reviewing the WordPress Plugin Handbook section on Security and the OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet.
Summary
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' and other shortcode attributes of the 'givewp_campaign_comments' shortcode. This occurs due to a lack of input sanitization in the shortcode parsing logic and insufficient output escaping when interpolating these attributes into HTML tags. Authenticated attackers with Author-level permissions can inject malicious scripts that execute in the context of any user viewing the affected page.
Vulnerable Code
// src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php:15 public function render(array $attributes, string $secondaryColor): string { $blockAttributes = BlockAttributes::fromArray($attributes); $encodedAttributes = json_encode($blockAttributes->toArray()); $blockId = $blockAttributes->blockId; return "<div id='givewp-campaign-comments-block-{$blockId}' data-secondary-color='{$secondaryColor}' data-givewp-campaign-comments data-attributes='{$encodedAttributes}'></div>"; } --- // src/Campaigns/Shortcodes/CampaignCommentsShortcode.php:78 return [ 'blockId' => (string) $atts['block_id'], 'campaignId' => (int) $atts['campaign_id'], 'title' => (string) $atts['title'], 'showAnonymous' => filter_var($atts['show_anonymous'], FILTER_VALIDATE_BOOLEAN), 'showAvatar' => filter_var($atts['show_avatar'], FILTER_VALIDATE_BOOLEAN), 'showDate' => filter_var($atts['show_date'], FILTER_VALIDATE_BOOLEAN), 'showComment' => filter_var($atts['show_comment'], FILTER_VALIDATE_BOOLEAN), 'count' => (int) $atts['count'], ];
Security Fix
@@ -10,16 +10,18 @@ class BlockRenderController { /** + * @since 4.16.1 escape attribute values in block markup * @since 4.0.0 */ public function render(array $attributes, string $secondaryColor): string { $blockAttributes = BlockAttributes::fromArray($attributes); - $encodedAttributes = json_encode($blockAttributes->toArray()); - - $blockId = $blockAttributes->blockId; - - return "<div id='givewp-campaign-comments-block-{$blockId}' data-secondary-color='{$secondaryColor}' data-givewp-campaign-comments data-attributes='{$encodedAttributes}'></div>"; + return sprintf( + "<div id='givewp-campaign-comments-block-%s' data-secondary-color='%s' data-givewp-campaign-comments data-attributes='%s'></div>", + esc_attr((string) $blockAttributes->blockId), + esc_attr($secondaryColor), + esc_attr((string) json_encode($blockAttributes->toArray())) + ); } } @@ -57,6 +57,7 @@ } /** + * @since 4.16.1 sanitize block_id from shortcode attributes * @since 4.5.0 */ private function parseAttributes($atts): array @@ -75,7 +76,7 @@ ], $atts, 'givewp_campaign_comments'); return [ - 'blockId' => (string) $atts['block_id'], + 'blockId' => sanitize_key((string) $atts['block_id']), 'campaignId' => (int) $atts['campaign_id'], 'title' => (string) $atts['title'], 'showAnonymous' => filter_var($atts['show_anonymous'], FILTER_VALIDATE_BOOLEAN),
Exploit Outline
The exploit requires an attacker to have the ability to create or edit posts (Author role or higher). The attacker uses the `[givewp_campaign_comments]` shortcode and provides a malicious value for the `block_id` attribute. By including a single quote in the `block_id` (e.g., `[givewp_campaign_comments block_id="' onmouseover='alert(1)' "]`), the attacker can break out of the `id` attribute generated in the `BlockRenderController::render()` method. When the page is rendered for a visitor, the injected HTML attribute or script will execute in the visitor's browser.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.