The GiveWP WordPress plugin contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input in the 'name' parameter. This allows unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting the injected pages. The vulnerability is present in all versions up to 4.13.0 and requires avatars to be enabled for exploitation. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation can lead to execution of arbitrary scripts in the context of users accessing the affected pages, potentially resulting in theft of sensitive information or session hijacking. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling avatars in WordPress to prevent exploitation, as avatars must be enabled for the vulnerability to be exploited. Monitor vendor channels for updates and apply patches promptly once available.