CVE-2024-27987
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts into web pages generated by the GiveWP Give plugin for WordPress. When a user visits a specially crafted URL, the script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf. It affects all WordPress sites using GiveWP Give plugin versions up to 3.3.1.
💻 Affected Systems
- WordPress GiveWP Give plugin
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, take over WordPress sites, deface content, install backdoors, or redirect users to malicious sites.
Likely Case
Attackers steal user session cookies, perform actions as authenticated users, or redirect to phishing pages.
If Mitigated
Script execution is blocked by Content Security Policy (CSP) headers or browser XSS filters, limiting damage to session theft.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is trivial to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.2 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/give/wordpress-give-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find GiveWP Give plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.3.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate GiveWP Give plugin until patched.
wp plugin deactivate give
Implement Content Security Policy
allAdd CSP headers to block inline script execution.
Add to .htaccess: Header set Content-Security-Policy "default-src 'self'"
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block XSS payloads in URLs.
- Restrict plugin access to trusted users only using WordPress role management.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for GiveWP Give version. If version is 3.3.1 or lower, you are vulnerable.Check Version:
wp plugin list --name=give --field=versionVerify Fix Applied:
Verify plugin version is 3.3.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests with script tags or JavaScript in query parameters
- Multiple 404 errors for crafted URLs
Network Indicators:
- HTTP requests containing <script>, javascript:, or encoded XSS payloads in URL parameters
SIEM Query:
source="web_server_logs" AND (url="*<script>*" OR url="*javascript:*" OR url="*%3Cscript%3E*")