CVE-2024-35679
📋 TL;DR
This CVE describes a reflected cross-site scripting (XSS) vulnerability in the GiveWP WordPress plugin. Attackers can inject malicious scripts via crafted URLs that execute when victims visit those links. All WordPress sites using GiveWP versions up to 3.12.0 are affected.
💻 Affected Systems
- GiveWP WordPress Plugin
📦 What is this software?
Givewp by Givewp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface websites, or redirect users to malicious sites.
Likely Case
Attackers craft phishing emails with malicious links that execute scripts in victims' browsers, potentially stealing session tokens or performing limited unauthorized actions.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly exploited via phishing campaigns. The vulnerability requires user interaction (clicking a malicious link).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.1 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-3-12-0-reflected-cross-site-scripting-xss-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GiveWP and click 'Update Now'. 4. Verify version is 3.12.1 or higher.
🔧 Temporary Workarounds
Disable GiveWP Plugin
allTemporarily disable the vulnerable plugin until patching is possible.
wp plugin deactivate give
Implement WAF Rules
allConfigure web application firewall to block XSS payloads targeting GiveWP endpoints.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Use browser security extensions that block reflected XSS attacks
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → GiveWP version. If version is 3.12.0 or earlier, you are vulnerable.Check Version:
wp plugin get give --field=versionVerify Fix Applied:
After updating, verify GiveWP version shows 3.12.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual GET requests with script tags or JavaScript in query parameters to GiveWP endpoints
- Multiple failed XSS attempts in web server logs
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in URL parameters
- Traffic patterns showing users being redirected after visiting GiveWP URLs
SIEM Query:
source="web_server_logs" AND (uri="*give*" AND (query="*<script>*" OR query="*javascript:*" OR query="*onload=*"))