What is the CVSS score of EUVD-2026-53899?

EUVD-2026-53899 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of GiveWP are affected by EUVD-2026-53899?

GiveWP WordPress plugin versions 4.16.5 and earlier contain an unauthenticated cross-site scripting vulnerability that enables attackers to harvest administrator and donor credentials through crafted…

How to fix or mitigate EUVD-2026-53899?

Within 24 hours, audit all WordPress installations for GiveWP versions 4.16.5 or earlier and disable the plugin immediately or restrict access to authenticated administrators only to prevent public-facing exploitation. Within 7 days, monitor GiveWP's official security advisory and release channels for patch availability, and establish a review process to validate the safe version before deployment. Within 30 days, deploy the vendor patch to all affected installations and conduct access logging review to detect any unauthorized credential or session compromise during the vulnerability window.

GiveWP EUVD-2026-53899

| CVE-2026-66690 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-q64f-8jfv-6r69

WordPress XSS Givewp Wordpress Plugin Nexcess

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

XSS with scope change justifies C:L and I:L in victim browser; A:N as XSS does not cause availability impact on the server or plugin.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:40 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

AnalysisAI

Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied input before rendering it in an HTML response. GiveWP is a WordPress donation and fundraising plugin attributed to Nexcess in NVD CPE data (cpe:2.3:a:nexcess:givewp). The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C indicates the vulnerability is network-reachable with no authentication required, low exploitation complexity, triggered by victim interaction (consistent with reflected XSS delivery), and with scope change - meaning the injected payload can affect the victim's browser session beyond the plugin's own security boundary. The root cause class is input validation failure in a WordPress plugin front-end rendering path, a common attack surface in donation form or shortcode rendering logic.

RemediationAI

The primary remediation is to update the GiveWP plugin beyond version 4.16.5; the exact patched release version is not independently confirmed in the available data beyond the boundary of 4.16.5 being vulnerable - consult the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-5-cross-site-scripting-xss-vulnerability for the confirmed fixed version. As a compensating control prior to patching, administrators can implement a web application firewall (WAF) rule to filter XSS payloads in requests to GiveWP-served endpoints, though this may introduce false positives on legitimate donation form submissions. Restricting access to GiveWP form endpoints to trusted IP ranges is not broadly feasible for public-facing donation sites and should only be considered for internal or restricted deployments. Administrators should also enforce strict Content-Security-Policy headers to limit the impact of any injected scripts.