EUVD-2026-50995
GHSA-h33v-3fv3-7p55
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
PR:H reflects mandatory GiveWP Worker role; A:L substituted for A:H as stored XSS has no direct availability impact on the server.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
AnalysisAI
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum the GiveWP Worker role within the targeted WordPress installation - this is not an unauthenticated or subscriber-level vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H reflects the central tension in this vulnerability: theoretically severe CIA impacts but gated behind a high-privilege precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a GiveWP Worker account - for example, a disgruntled volunteer or a credentials-compromised fundraising staff member - edits a donation-form template setting and injects a JavaScript payload into a field that renders unsanitized in an HTML attribute. Every visitor who subsequently loads the public donation form executes the script in their browser, enabling session cookie theft, credential harvesting via a spoofed payment overlay, or redirection to a phishing site. … |
| Remediation | Upgrade GiveWP to version 4.16.3 or later, which is the vendor-released patch confirmed by WPScan and EUVD-2026-50995; the fix can be applied via the standard WordPress plugin update mechanism from the dashboard or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severi
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical sever
The give plugin before 2.4.7 for WordPress has XSS via a donor name. Rated medium severity (CVSS 5.4), this vulnerabilit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today