GiveWP EUVD-2026-57914

The attacker must be able to submit a donation or donor record via the GiveWP public-facing form - this typically requires no WordPress account, only access to a published donation form on the target site. The CVSS PR:L suggests some low-level privilege is required for the injection step (potentially a registered donor account depending on plugin configuration). Exploitation requires a privileged WordPress user (administrator or editor with access to donation records) to subsequently view the page rendering the donor data (UI:R). Exploitation is limited to sites running GiveWP versions below 4.16.6 with at least one published donation form. There is no indication that non-default configuration is required - the donor submission and admin review flow is core GiveWP functionality.

The NVD CVSS 6.5 reflects the S:C (Changed) scope, which is the most significant risk amplifier here - an attacker with only donor-level access (PR:L) can reach the administrative context (admin browser session). EPSS data is not provided, and there is no CISA KEV listing, indicating no confirmed widespread exploitation. No POC has been identified. Despite the moderate base score, the practical impact is higher than the numeric suggests: successful exploitation against an administrator could yield full site compromise via WordPress admin account takeover. The UI:R requirement (admin must view the donor record) is a meaningful limiting factor and reduces automatable mass exploitation. AC:L indicates no special conditions beyond submitting a donation payload, which is low friction for an attacker. The A:L (availability) metric in the provided vector is atypical for XSS and is likely inflated - direct availability impact from a reflected/stored XSS is rare unless the payload performs a destructive admin action.

An attacker submits a donation through the public-facing GiveWP form, injecting a JavaScript payload (e.g., a cookie-stealing script) into a donor name or custom input field. When a WordPress administrator navigates to the donation or donor management panel to review records, the stored payload fires in their browser session, exfiltrating the admin's session cookie or silently creating a rogue admin account. No POC has been publicly identified, but this attack pattern is trivially constructable from the vulnerability class.