The GiveWP WordPress plugin before version 4.16.3 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, it fails to escape a donation-form template setting before rendering it in an HTML attribute. This flaw permits users with the GiveWP Worker role or above to inject malicious scripts that execute in the context of the public donation form, potentially impacting confidentiality, integrity, and availability of affected sites. The vulnerability is network exploitable with low attack complexity but requires high privileges and user interaction to exploit.

Successful exploitation allows an attacker with GiveWP Worker role or higher to execute arbitrary JavaScript in the browsers of visitors to the donation form. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected website. The attack requires the attacker to have elevated privileges within the WordPress site and user interaction (visiting the donation form).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, restrict the assignment of the GiveWP Worker role to trusted users only and monitor for suspicious activity related to donation form settings.