GiveWP EUVD-2026-92300

Exploitation requires an authenticated WordPress account with at least low-level privileges on a site running the GiveWP (give) plugin version 4.17.0 or earlier (PR:L). The attacker must be able to submit input through a GiveWP-controlled field that is stored and later rendered without proper output encoding. Successful execution additionally requires a victim user (such as a site administrator) to view the page containing the stored payload (UI:R), which limits exploitation to multi-user environments and makes it non-viable against a single-administrator install with no untrusted accounts. The specific GiveWP field/screen affected is not named in the available data and should be confirmed against the Patchstack advisory.

This is a Stored Cross-Site Scripting flaw (CWE-79) in GiveWP, carrying a vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent but point to a conditional rather than wormable threat: PR:L means an attacker must already hold a low-privileged authenticated account on the WordPress site, and UI:R means a victim (typically an administrator or another user) must subsequently view the page where the malicious payload is rendered. The S:C (scope change) and low C/I/A reflect the classic XSS pattern where injected script executes in another user's browser context rather than directly compromising the server. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. This CVE is not listed in CISA KEV and no public exploit code was supplied, so there is no public exploit identified at time of analysis. Net assessment: a genuine but moderate-priority issue - meaningful for multi-user WordPress sites running GiveWP where low-trust accounts exist (donor/contributor roles), but not a drop-everything remote-unauthenticated RCE. Prioritize patching on sites with untrusted authenticated users; lower urgency on single-admin installations.

An attacker with a low-privileged authenticated account on a WordPress site running GiveWP ≤4.17.0 submits input through a GiveWP field that is improperly neutralized, storing a malicious JavaScript payload. When a site administrator or other user later views the affected page (e.g., a donation/form management screen in wp-admin), the script executes in their browser, enabling session/cookie theft or admin-context actions. No public proof-of-concept was provided in the input, and successful exploitation depends on the victim viewing the injected content (UI:R).