What is the CVSS score of CVE-2026-42678?

CVE-2026-42678 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of GiveWP are affected by CVE-2026-42678?

GiveWP, a WordPress donation plugin used by many organizations, contains a cross-site scripting vulnerability affecting all versions through 4.14.5.

How to fix or mitigate CVE-2026-42678?

Within 24 hours: Inventory all WordPress installations to identify GiveWP 4.14.5 or earlier usage. Within 7 days: Disable GiveWP if using affected versions, or implement WAF rules to detect and block DOM-based XSS payloads targeting the plugin. Within 30 days: Monitor vendor security advisories for patch release; evaluate alternative donation platforms; conduct donor data security audit.

GiveWP CVE-2026-42678

EUVD-2026-33684 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-01 Patchstack

GHSA-6rpm-7x8w-42p8

XSS Givewp

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 17:16 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS.

This issue affects GiveWP: from n/a through 4.14.5.

AnalysisAI

DOM-based cross-site scripting in the GiveWP WordPress donation plugin (versions up to and including 4.14.5) allows remote attackers to execute arbitrary JavaScript in a victim's browser session after the victim interacts with an attacker-supplied link or page element. The flaw carries a CVSS 7.1 score driven by changed scope (S:C), meaning impact extends beyond the vulnerable component into the surrounding WordPress site context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

GiveWP is a widely deployed WordPress donation/fundraising plugin maintained by Liquid Web / StellarWP, identified by CPE cpe:2.3:a:liquid_web_/_stellarwp:givewp. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a DOM-based variant where untrusted input flows through client-side JavaScript sinks (e.g., innerHTML, document.write, jQuery .html()) without proper neutralization. Unlike reflected or stored XSS, DOM-based XSS executes entirely in the browser when client-side script reads attacker-controllable values (URL fragments, query parameters, postMessage data) and injects them into the DOM, meaning the payload may never appear in server logs.

RemediationAI

Upgrade GiveWP to a version newer than 4.14.5 once StellarWP publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-14-5-cross-site-scripting-xss-vulnerability and the StellarWP changelog for the exact patched build, as no vendor-released patched version was independently confirmed in the available data. As compensating controls until a patch is applied, deploy a strict Content-Security-Policy header that disables inline script and restricts script-src to trusted origins (note this can break legitimate plugin functionality and must be tested), enable a WordPress-aware WAF such as Patchstack, Wordfence, or Sucuri with virtual-patching for this CVE, restrict /wp-admin access by IP to limit exposure of authenticated administrators to malicious links, and instruct site administrators to avoid clicking GiveWP-related URLs from untrusted sources until the upgrade is completed.