GiveWP EUVD-2026-50995

Exploitation requires the attacker to hold at minimum the GiveWP Worker role within the targeted WordPress installation - this is not an unauthenticated or subscriber-level vulnerability. The GiveWP Worker role must have been granted by a site administrator, making this primarily an insider-threat or account-takeover scenario. The malicious payload is stored server-side and fires when any unauthenticated visitor loads the public donation form (UI:R from the attacker's perspective, meaning victim interaction drives execution). No special server configuration, non-default plugin settings, or specific hosting environment is required beyond having GiveWP installed and a donation form published. Exploitation is limited to pre-4.16.3 versions of the plugin and is scoped to the donation form rendering path - other WordPress pages are not directly affected by this injection point.

The CVSS 3.1 base score of 6.8 with vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H reflects the central tension in this vulnerability: theoretically severe CIA impacts but gated behind a high-privilege precondition. PR:H correctly maps to the GiveWP Worker role requirement, meaning the attacker must already have a trusted role within the site's donation management system - this is not an external unauthenticated threat. UI:R further reduces real-world risk because exploitation relies on a visitor loading the poisoned form. EPSS at 0.17% (7th percentile) is consistent with this picture: the exploit chain is technically simple but the privilege prerequisite screens out most opportunistic actors. The A:H component of the provided CVSS vector appears generous for a standard stored XSS; availability impact is not a direct consequence of script injection unless leveraged for further attack. A POC is publicly documented via WPScan, which means the technique is well-understood and could be operationalized quickly by an insider threat or a compromised low-level admin account. No CISA KEV listing confirms no confirmed mass exploitation at time of analysis. Net assessment: medium real-world priority; highest risk in multi-tenant or volunteer-staffed nonprofit WordPress environments where the Worker role is granted broadly.

An attacker who holds a GiveWP Worker account - for example, a disgruntled volunteer or a credentials-compromised fundraising staff member - edits a donation-form template setting and injects a JavaScript payload into a field that renders unsanitized in an HTML attribute. Every visitor who subsequently loads the public donation form executes the script in their browser, enabling session cookie theft, credential harvesting via a spoofed payment overlay, or redirection to a phishing site. A publicly available proof-of-concept documented by WPScan confirms the injection technique is known and replicable.