EUVD-2026-44859
GHSA-v6f8-q5jg-rg7r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R corrects the provided UI:N because donor must actively click Share on Twitter; PR:L retained for required give worker authentication; S:C retained for cross-browser-boundary impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.
AnalysisAI
Stored XSS in GiveWP's Sequoia donation template allows authenticated attackers with give worker-level access to inject persistent JavaScript payloads via the 'twitter_message' template setting, affecting all WordPress installations running plugin versions through 4.16.3. The injected payload is not sanitized before being embedded inside a JavaScript template literal in the Sequoia confirmation view's social-sharing component, and executes in the donor's browser specifically when they click the 'Share on Twitter' button after completing a donation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the Wordfence disclosure includes direct source code references confirming the unsanitized evaluation path.
Technical ContextAI
GiveWP (CPE: cpe:2.3:a:stellarwp:givewp_-_donation_plugin_and_fundraising_platform:*:*:*:*:*:*:*:*) is a StellarWP donation management plugin for WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). Specifically, the 'twitter_message' value set in the Sequoia Template settings is stored without sufficient sanitization (evidenced by the code path through includes/admin/forms/class-metabox-form-data.php#L1180 and includes/formatting.php#L768) and is later rendered unescaped inside a JavaScript template literal in src/Views/Form/Templates/Sequoia/views/social-sharing.php#L41. JavaScript template literals (backtick strings) interpret embedded expressions at runtime, meaning a stored value containing ${...} or closing/opening backtick sequences can break out of the literal context and execute arbitrary code. This is a classic second-order XSS pattern: the payload is written by an admin-adjacent role and detonates in a victim's browser at a later, separate interaction.
RemediationAI
Update GiveWP to a version later than 4.16.3; a fix commit is available in the WordPress plugin SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3607718%40give&new=3607718%40give, though an independently confirmed patched release version number (e.g., 4.16.4) is not explicitly stated in the available references - verify the exact patched release via the WordPress plugin repository or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd0ba4b-56f1-4f4b-95f7-28c911c8de09. If immediate patching is not possible, a targeted workaround is to disable the Sequoia template's 'Share on Twitter' social sharing feature entirely, which prevents the vulnerable template literal from ever being rendered; this has the trade-off of removing donor social sharing functionality. Alternatively, restrict the give worker role assignment to only fully trusted internal staff, reducing the attacker pool. Auditing existing 'twitter_message' settings for unexpected content is also advised as a post-incident measure.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today