CVE-2024-13690
Published: 25 March 2025
Summary
CVE-2024-13690 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-13690 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the WP Church Donation plugin for WordPress. It affects all versions up to and including 1.7 due to insufficient input sanitization and output escaping in several donation form submission parameters. This flaw enables the injection of arbitrary web scripts into pages, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Unauthenticated attackers can exploit the vulnerability remotely with low complexity, no required privileges, and no user interaction. By submitting malicious payloads through the donation form parameters, attackers store scripts on affected pages. These scripts execute in users' browsers whenever the injected pages are accessed, potentially compromising session data or performing actions on behalf of victims within the site's scope.
Advisories and references, including the Wordfence threat intelligence report and the plugin's WordPress.org page, provide details on the vulnerability. Source code from version 1.7 in files such as church-donation-form-display.php and church-donation-listings.php highlights the unsanitized parameters responsible for the issue. Security practitioners should review these resources for recommended mitigations, such as updating the plugin if patches are available beyond version 1.7.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8065
Vulnerability details
The WP Church Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several donation form submission parameters in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for…
more
unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin enables T1190 (exploiting public-facing app via form injection), T1059.007 (arbitrary JavaScript execution in browser), and T1185 (session hijacking to compromise data).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of donation form submission parameters to prevent injection of arbitrary web scripts due to insufficient input sanitization.
Filters and escapes output on affected pages to block execution of injected scripts whenever users access the pages, addressing lack of output escaping.
Identifies, patches, and verifies remediation of the specific flaw in the WP Church Donation plugin versions up to 1.7.