What is the CVSS score of CVE-2026-34900?

CVE-2026-34900 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-34900?

Within 24 hours: Verify GiveWP version on all WordPress installations; disable the plugin immediately if version 4.14.2 or lower and document impact. Within 7 days: Contact GiveWP support for patch timeline confirmation; implement WAF rules blocking reflected XSS patterns if the plugin must remain operational. Within 30 days: Upgrade to the patched version once released by GiveWP or deploy alternative donation processing solution.

GiveWP CVE-2026-34900

EUVD-2026-36921 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-ccj6-3h2m-whv5

XSS Givewp

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS reachable over the network without authentication but needing a victim click; scope changes to the browser session, yielding low C/I/A impact on the user context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:36 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

AnalysisAI

Unauthenticated reflected cross-site scripting in the GiveWP WordPress donation plugin (versions ≤4.14.2) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the user clicks a crafted link. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36921; no public exploit identified at time of analysis, and the CVSS scope-change rating of 7.1 reflects potential session hijacking or administrative action abuse against logged-in WordPress users including site administrators.

Technical ContextAI

GiveWP (CPE cpe:2.3:a:liquid_web_/_stellarwp:givewp) is a widely deployed WordPress fundraising and donation plugin maintained by Liquid Web / StellarWP. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS pattern where attacker-controlled input from an HTTP request parameter is echoed back into a rendered page without adequate output encoding or input sanitization. Because WordPress plugins typically render output within the same origin as the site's admin dashboard, an XSS payload executes in the security context of whichever user follows the malicious link, including potential donors, editors, or administrators.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the supplied data - administrators should upgrade GiveWP to the latest release above 4.14.2 as published by StellarWP and verify the version via the WordPress plugin manager, consulting https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-14-2-reflected-cross-site-scripting-xss-vulnerability for the exact fixed build. As a compensating control until patched, deploy a WordPress-aware WAF rule (Patchstack, Wordfence, or Cloudflare managed rules) to filter reflected XSS payloads on GiveWP endpoints, restrict /wp-admin access by IP allowlist to reduce administrator exposure to phishing links, and enforce a strict Content-Security-Policy that disallows inline script execution - noting that strict CSP may break legitimate GiveWP donation widgets and requires testing on a staging site.