Description

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:22.230Z",
  "pubdate": "2026-08-06T15:17:22.230Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the GiveWP plugin, specifically affecting versions 4.16.5 and prior. This security flaw enables remote, unauthenticated threat actors to inject and execute arbitrary client-side scripts, such as malicious JavaScript, within the context of a victim's browser session. The vulnerability poses significant risk implications, including potential session hijacking, unauthorized actions performed on behalf of authenticated users, defacement, and redirection to malicious external resources. Exploitation requires no prior authentication or elevated privileges, making it accessible to external attackers interacting over the network with the target WordPress installation. Attackers typically exploit this vector by crafting a malicious payload and enticing a user or administrator to interact with a vulnerable endpoint or parameter processed by the application. Remediation requires updating the affected GiveWP product to a patched version once released by the vendor, as unauthenticated injection flaws in widely deployed plugins significantly expand the attack surface of content management systems.",
  "technicalDetails": "The vulnerability resides within the request handling and output rendering mechanisms of the GiveWP plugin for WordPress, specifically impacting all versions up to and including 4.16.5. The root cause stems from insufficient input sanitization and a lack of proper contextual output encoding on user-supplied parameters processed by the application. Because the vulnerability is unauthenticated and exposed over the network, an external threat actor can interact directly with vulnerable endpoints without needing valid user credentials or specific privilege levels.\nThe attack flow begins when an attacker crafts a malicious input string containing executable JavaScript payloads disguised as standard HTTP request parameters or input fields handled by the GiveWP plugin. When an unauthenticated HTTP request containing this payload is sent to the target server, the vulnerable component fails to adequately neutralize or sanitize the malicious input before storing or reflecting it back in the Document Object Model (DOM) of the HTTP response. Upon rendering the response, the browser executes the injected script within the security context of the victim's session.\nIf the victim interacting with the payload possesses administrative or high-privileged roles within the WordPress environment, the executed payload operates with those elevated privileges. This enables post-exploitation activities such as the programmatic creation of backdoor administrative accounts, the modification of critical site settings, or the exfiltration of sensitive session cookies and authorization tokens. The network exposure is broad, as any publicly accessible WordPress instance running the vulnerable GiveWP versions <= 4.16.5 is susceptible to this injection vector unless compensatory controls or software updates are applied."
}