GiveWP CVE-2026-42678

The victim must click an attacker-controlled URL targeting a GiveWP donation/campaign page on a WordPress site running GiveWP 4.14.5 or earlier (UI:R in CVSS vector). No authentication is required of the attacker (PR:N), and the attacker does not need an account on the target WordPress site, but the impact is maximized when the clicking victim is an authenticated WordPress administrator whose session can then be hijacked. Exploitation is limited by the requirement for victim interaction, browser-side execution context (DOM-based, so server-side WAF rules that inspect request bodies may not see the payload if it travels in the URL fragment), and the need for the target WordPress site to have the GiveWP plugin installed and active.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity exploitation requiring no privileges but requiring user interaction (UI:R) - typically clicking a crafted link. The Scope:Changed designation elevates risk because XSS in a donation plugin can pivot to stealing session cookies of authenticated WordPress administrators or donors, harvesting donor PII, or hijacking payment flows. EPSS data was not provided in the input, and the CVE is not in CISA KEV, so this appears to be a disclosed-but-not-actively-exploited issue at this time. The UI:R requirement and DOM-based nature limit mass-exploitation potential compared to server-side RCE flaws, but the very large GiveWP install base on WordPress and the financial context of the plugin make targeted attacks (e.g., spear-phishing donation page links to admins) plausible.

An attacker crafts a URL pointing to a GiveWP-rendered page (such as a donation form or campaign page) with a malicious payload embedded in a URL fragment or query parameter that the plugin's client-side JavaScript reflects into the DOM without sanitization. The attacker delivers the link via phishing email, social media, or a malicious referrer to a WordPress administrator or donor, and on click the JavaScript executes in the victim's browser under the target site's origin, enabling session cookie theft, admin account takeover, or manipulation of donation forms. No public proof-of-concept was identified at time of analysis.