CVE-2026-111979: CWE-79 Cross-Site Scripting (XSS) in GiveWP
Affects GiveWPSource CVE Database V5
Not known to be exploited.
Data as of 10/25/2026, 06:20:55 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| GiveWP | Affected
| Fixed in
|
AI-suggested
Upgrade the GiveWP plugin to version 4.19.0.1 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is confirmed by the version boundary in the description. Users should apply the official update to remediate this issue.
Description
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
Impact
Successful exploitation enables an attacker with custom form-editing privileges to execute arbitrary JavaScript in the browsers of users who view the compromised donation form. This could lead to session hijacking, defacement, or other client-side attacks. However, exploitation requires the attacker to have a specific role within the WordPress environment, limiting the attack vector to authorized users with form-editing capabilities.
Weaknesses
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #1OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.