GiveWP CVE-2026-111979

Exploitation requires an account already assigned a custom GiveWP role with donation-form-editing capability (PR:H) - this is not available to anonymous visitors or standard subscribers, so the attacker must already be a trusted-but-limited user or have obtained such an account. The payload is stored in one donation form template setting that is output unescaped inside an HTML attribute; execution additionally requires a victim (any site visitor or an administrator) to actually open the affected donation form (UI:R). Limiting factors: the privileged-role prerequisite substantially narrows the attacker population, and the need for a victim to view the specific form gates impact. The flaw affects all GiveWP versions before 4.19.0.1; updating to 4.19.0.1 is the vendor-provided fix.

This is a stored cross-site scripting (CWE-79) flaw in the GiveWP donation plugin, rated CVSS 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). The signals converge on a moderate, non-urgent priority rather than an emergency. The CVSS vector requires high privileges (PR:H) - specifically a user already granted a custom GiveWP form-editing role - plus victim interaction (UI:R), so it is not a remote-unauthenticated issue. EPSS is low at 0.15% (4th percentile), it is NOT on CISA KEV, and the vuln.today decision label is 'this_month' (not act_now/emergency), all consistent with no observed mass exploitation. A PoC/exploit reference from WPScan exists but is not verified as working exploit code, so public-exploit maturity is unconfirmed. One tension worth noting: the input CVSS assigns C:H/I:H/A:H, which is aggressive for a stored XSS whose real-world impact is typically scoped to the compromised browser session (e.g., hijacking an administrator who opens the form) rather than full confidentiality/integrity/availability loss of the host - treat the 6.8 as a reasonable ceiling and weigh the privilege prerequisite heavily. Net: a real but lower-tier issue, appropriately patched on a routine cycle, not a drop-everything emergency.

An attacker who already holds a custom GiveWP form-editing role (an insider or a lower-trust contributor given form rights) edits a donation form template setting and injects a malicious script into a field that is rendered unescaped inside an HTML attribute. When a site visitor or, more dangerously, a logged-in administrator opens the affected donation form, the script executes in their browser, enabling session/cookie theft or actions in the admin context. A public PoC reference exists but is not verified as working exploit code.