CVE-2026-34900 is an unauthenticated cross-site scripting (XSS) vulnerability in GiveWP, a product by Liquid Web / StellarWP, affecting versions up to 4.14.2. The issue stems from improper neutralization of input during web page generation (CWE-79), allowing attackers to execute arbitrary scripts in the context of the affected web application. The vulnerability has a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability. No patch or official remediation level has been published as of the data provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in theft of sensitive information, manipulation of web content, or disruption of service. The vulnerability requires user interaction but no privileges or authentication, increasing the risk exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying temporary mitigations such as input validation or web application firewall (WAF) rules targeting XSS payloads specific to GiveWP. Avoid relying on generic mitigations unless they are tailored to this vulnerability.