GiveWP EUVD-2026-93079

Exploitation requires an unauthenticated attacker to deliver a crafted XSS payload (e.g., via a malicious link or injected form parameter) AND requires victim user interaction (UI:R) - a user must visit the attacker-controlled or crafted page for the script to execute. Affects default installations of GiveWP versions through 4.17.0 on WordPress; no special plugin configuration is indicated as a prerequisite. The primary limiting factor is the mandatory user-interaction step, which prevents fully automated, drive-by mass exploitation and constrains the attack to social-engineering-style delivery against site visitors or administrators.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.1 is driven primarily by the network attack vector (AV:N), low complexity (AC:L), lack of authentication (PR:N), and the scope change (S:C) inherent to XSS executing in a victim's browser context - not by severe direct impact, which is limited (C:L/I:L/A:L). Critically, exploitation requires user interaction (UI:R), meaning a victim must be lured into visiting a crafted page or clicking a malicious link, which substantially lowers real-world exploitability compared to a no-interaction flaw. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active exploitation. No SSVC decision data is provided. Signals are internally consistent (the CVSS vector matches an unauthenticated, interaction-dependent XSS), so no conflicts require vendor verification. Net assessment: a legitimate vulnerability warranting patching on a normal maintenance cadence, but not a drop-everything emergency given the required user interaction, limited impact, and absence of exploitation evidence.

An attacker crafts a malicious URL or payload targeting a vulnerable GiveWP donation form or parameter and lures a site visitor or administrator into clicking it; when the victim's browser renders the page, attacker-controlled JavaScript executes in the context of the WordPress site. This can lead to session/cookie theft, UI redressing, or actions performed as the victim. No public exploit code is identified at time of analysis, and the low-complexity network vector means a working payload would be straightforward to develop once the injection point is known.