GiveWP Vulnerability– Donation Plugin and Fundraising Platform – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1424 | WordPress Plugin Vulnerability Report

Plugin Name: GiveWP – Donation Plugin and Fundraising Platform

Key Information:

  • Software Type: Plugin
  • Software Slug: give
  • Software Status: Active
  • Software Author: webdevmattcrom
  • Software Downloads: 6,822,276
  • Active Installs: 100,000
  • Last Updated: March 19, 2024
  • Patched Versions: 3.6.0
  • Affected Versions: <= 3.5.1

Vulnerability Details:

  • Name: GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1424
  • CVSS Score: 6.4
  • Publicly Published: March 19, 2024
  • Researcher: Bassem Essam
  • Description: The GiveWP plugin, a cornerstone for WordPress-based fundraising efforts, exhibits a vulnerability in versions up to 3.5.1, where insufficient sanitization of user-supplied attributes in the plugin's shortcodes allows authenticated users with contributor-level permissions or higher to embed malicious scripts. These scripts can execute various malicious activities when accessed by unsuspecting users, posing a significant risk to website integrity and user security.


The GiveWP plugin, integral for facilitating donations on WordPress sites, was recently found to harbor a Stored Cross-Site Scripting vulnerability in versions up to and including 3.5.1. This critical flaw, designated as CVE-2024-1424, compromised the security of numerous websites by allowing contributors to inject harmful scripts. Thankfully, this vulnerability was swiftly addressed in the 3.6.0 update, reinforcing the plugin's defense against such exploits.

Detailed Overview:

Identified by cybersecurity researcher Bassem Essam, this vulnerability underscores the intricate challenges within web security, particularly in the realm of charitable transactions. The flaw resided in the way the GiveWP plugin processed shortcode attributes, lacking rigorous checks to prevent malicious code insertion. The prompt issuance of a patched version mitigates the immediate threat but also serves as a reminder of the ever-present need for diligent security practices in plugin development and usage.

Advice for Users:

  • Immediate Action: To safeguard your fundraising efforts and website security, updating to GiveWP version 3.6.0 is imperative. This update rectifies the vulnerability, ensuring your donation platform remains secure.
  • Check for Signs of Vulnerability: Administrators should scrutinize their sites for unexpected shortcode behavior or unauthorized script injections, especially in pages utilizing GiveWP's functionalities.
  • Alternate Plugins: While the patched version of GiveWP addresses this specific concern, exploring other reputable donation plugins can provide additional security layers and feature sets.
  • Stay Updated: The cornerstone of maintaining a secure WordPress site lies in the consistent updating of all plugins and themes. Regular checks for updates can preempt the exploitation of vulnerabilities, maintaining the sanctity of your digital presence.


The discovery and subsequent resolution of CVE-2024-1424 within the GiveWP plugin highlights the dynamic landscape of cybersecurity within the WordPress ecosystem. For site owners, particularly those in the non-profit sector relying on donations, the incident reinforces the critical nature of vigilant software maintenance. By ensuring all components of your WordPress site are up-to-date, you safeguard not only your platform but also the trust and security of your supporters.


Detailed Report: 

In the interconnected world of the internet, where WordPress stands as a towering platform for countless websites, the security of each plugin becomes a cornerstone for safeguarding digital presences. The GiveWP – Donation Plugin and Fundraising Platform, a revered tool in the realm of charitable giving, recently found itself at the center of a security scrutiny with the discovery of CVE-2024-1424. This vulnerability brought to light the ever-present need for vigilance and the importance of keeping website components up to date, especially for small business owners who rely on their websites as pivotal conduits to their audience.

About GiveWP – Donation Plugin and Fundraising Platform

GiveWP has carved a niche in the WordPress ecosystem, empowering over 100,000 active installations with the ability to seamlessly accept donations. Crafted by webdevmattcrom, the plugin has seen over 6.8 million downloads, a testament to its utility and reliability in facilitating fundraising efforts. Despite its widespread acclaim, the plugin's integrity was challenged by a vulnerability in versions up to and including 3.5.1, casting a spotlight on the need for continuous monitoring and updating of such crucial tools.

Unveiling the Vulnerability: CVE-2024-1424

CVE-2024-1424 exposed a Stored Cross-Site Scripting (XSS) flaw within GiveWP, where insufficient sanitization of shortcode attributes allowed contributors or higher-level users to embed harmful scripts. This breach, identified by researcher Bassem Essam, could lead to unauthorized actions being taken on the site, compromising both the website's integrity and the security of its users. The patched version 3.6.0 promptly addressed this critical issue, reinstating the plugin's security.

Potential Risks and Impact

The vulnerability posed significant risks, particularly to non-profit organizations that hinge on the trust and goodwill of their donors. Any exploitation could undermine donor confidence, disrupt fundraising efforts, and even lead to broader security breaches within affected websites. The incident underscores the multifaceted impact of such vulnerabilities, extending beyond technical glitches to potentially eroding the very foundation of trust upon which charitable organizations are built.

Remediation and Proactive Measures

In response to CVE-2024-1424, the immediate update to version 3.6.0 is imperative for all users of the GiveWP plugin. This remediation step is crucial in sealing the exposed security gap. Additionally, website administrators are encouraged to conduct thorough reviews for any signs of compromise and to remain vigilant by regularly updating all site components. The exploration of alternate plugins should also be considered as part of a diversified approach to site functionality and security.

Navigating Past Vulnerabilities

This is not the first challenge faced by GiveWP, with 37 vulnerabilities reported since April 20, 2015. Each incident serves as a learning curve, contributing to the plugin's resilience and the broader WordPress community's understanding of digital security.

The Critical Nature of Security Awareness

For small business owners, the incident highlights the critical importance of maintaining an up-to-date digital infrastructure. The swift resolution of CVE-2024-1424 by GiveWP's developers serves as a reminder of the dynamic nature of web security and the continuous need for vigilance. Staying abreast of updates and potential vulnerabilities is not just a technical necessity but a fundamental aspect of digital stewardship, ensuring the security and reliability of platforms that play crucial roles in fundraising and community building. In the fast-paced digital world, the commitment to security is an ongoing journey, pivotal in fostering trust and ensuring the enduring success of online endeavors.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

GiveWP Vulnerability– Donation Plugin and Fundraising Platform – Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1424 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment