GiveWP CVE-2026-5510

The attacker must hold at minimum Contributor-level authenticated access to the target WordPress installation; unauthenticated exploitation is not possible given PR:L in the CVSS vector. The GiveWP plugin must be installed, active, and running version 4.14.4 or earlier. The attack requires inserting the give_form shortcode with a crafted continue_button_title or display_style attribute value into a post or page, meaning the attacker's account must have shortcode rendering permissions - standard for Contributor and above in WordPress. Exploitation is further limited to environments where published pages are accessible to other users; a site that requires login to view all pages limits the victim pool to authenticated users only. WordPress sites that enforce post moderation or approval workflows before publication can also delay or prevent exploitation by requiring editorial review of contributor-submitted content.

The CVSS 3.1 base score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N correctly identifies the key risk dimensions: the attack is network-accessible and low-complexity, but requires Contributor-level authentication (PR:L), which is the primary mitigating factor. The changed scope (S:C) reflects that the XSS executes in victim browsers, a distinct security boundary from the server. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified; however, the absence of CISA KEV listing and no public proof-of-concept in the referenced intelligence suggests this is not under active mass exploitation at time of analysis. The combination of a well-known vulnerability class (stored XSS in a shortcode attribute), a widely-deployed plugin, and the moderate access barrier means that even a mid-sized nonprofit IT team in malbork running open contributor registration on their fundraising site should treat this as an elevated patching priority - the risk is substantially higher on sites with loosely controlled contributor accounts or user-generated content workflows. The S:C designation is particularly notable for donation platforms, where a working XSS payload could silently redirect donors to phishing pages or harvest payment-adjacent session data, amplifying impact well beyond the raw CVSS score suggests.

An attacker who has registered or compromised a Contributor-level account on a WordPress site running GiveWP through 4.14.4 inserts the give_form shortcode with a malicious JavaScript payload embedded in the continue_button_title attribute into any post or page they can publish. Every subsequent visitor to that page - including donors entering payment details or site administrators - automatically executes the attacker's script in their browser, enabling session hijacking, credential phishing overlays, or silent form-data exfiltration. No public proof-of-concept code was referenced in the available intelligence, but the attack requires only basic shortcode knowledge and standard XSS payload construction.