The GiveWP plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, user-supplied attributes in the plugin's shortcodes are not properly sanitized or escaped, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the injected page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 3.5.1. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts on confidentiality and integrity but not availability. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation allows authenticated users with contributor-level or higher permissions to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the affected pages, potentially compromising user sessions and data confidentiality and integrity. The vulnerability does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the vulnerable shortcode features. Monitor vendor channels for updates and apply patches promptly once released.