GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Reflected Cross-Site Scripting via Stripe Webhook Event Type
- ID
- WPSEC-2026-0361
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 2.21.3 before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- GiveWP – Donation Plugin and Fundraising Platform on WPSec AttackSurface
- Fix released
- Published
Description
The GiveWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the event type sent to the Stripe webhook listener in versions 2.21.3 up to, and including, 4.17.0. This is due to the listener building its response from the unverified event type in the request body and printing it without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as submitting a crafted form from an attacker-controlled page. The listener is loaded only when a Stripe payment method is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0361/
- https://plugins.svn.wordpress.org/give/tags/4.18.0/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS