GiveWP CVE-2026-66690

Exploitation requires that the target WordPress site has the GiveWP plugin installed and active at version 4.16.5 or earlier. No attacker authentication is required (PR:N confirmed by CVSS vector). Exploitation is limited by the mandatory victim interaction requirement (UI:R) - a target user must be induced to visit a crafted URL or interact with a malicious link, meaning passive scanning without victim engagement cannot trigger the vulnerability. The XSS payload must survive whatever input handling the plugin applies, but AC:L indicates no special evasion or race condition is needed. Sites not running GiveWP, or those already updated past the vulnerable version boundary, are not affected.

The NVD CVSS score of 7.1 (High) reflects the combination of network accessibility, no authentication requirement, and scope change, which are strong risk amplifiers. However, the UI:R metric limits exploitation to scenarios where a victim must be induced to interact - this is a meaningful friction point that reduces the likelihood of opportunistic mass exploitation compared to a fully automated attack. No EPSS data was provided in the intelligence, and neither CISA KEV status nor public exploit code was identified, suggesting no confirmed active exploitation at time of analysis. The real-world risk is meaningful for sites with authenticated administrators or repeat donors who could be targeted via phishing, but the absence of exploitation signals and the UI:R requirement place this below the priority tier of, for example, unauthenticated RCE vulnerabilities. Organizations running GiveWP on sites that collect donor payment data should treat this as a prompt but not emergency patch.

An attacker identifies a WordPress site running GiveWP 4.16.5 or earlier, crafts a URL or form submission containing a malicious JavaScript payload that is reflected back in the plugin's output without proper encoding, then delivers this link via phishing email to a site administrator or authenticated donor. When the victim clicks the link, the script executes in their browser under the site's origin, allowing the attacker to steal session cookies, capture form data, or redirect the victim to a credential-harvesting page. No public proof-of-concept code has been identified, but the low attack complexity suggests the vulnerability is straightforward to reproduce from the Patchstack disclosure.