Amonra

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.4 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with give worker-level access and above to perform Stored Cross-Site Scripting. The issue occurs when the `twitter message` Sequoia Template Setting is used, allowing the injection of arbitrary web scripts. These scripts execute when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as the unescaped `twitter message` value is evaluated within a JavaScript template literal. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.4 or later.

**Name of the Vulnerable Software and Affected Versions** GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.1 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of user-supplied attributes within the `givewp campaign comments` shortcode. Specifically, the `block id` and other attributes are processed in the `CampaignCommentsShortcode::parseAttributes()` and `BlockRenderController::render()` functions, where the `blockId` value is interpolated directly into a single-quoted HTML attribute without using `esc attr()`. This allows authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages that execute when accessed by other users. **Recommendations** Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.1 or later.