Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP:… (CVE-2025-66533)

CVE-2025-66533 describes a code injection vulnerability in the StellarWP GiveWP plugin affecting versions up to 4.13.1. The vulnerability arises from improper control of code generation, which can be exploited by an attacker with low privileges and no user interaction required. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No official patch or fix details are available in the provided data.

Successful exploitation could allow an attacker with low privileges on the system to execute arbitrary code, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data access, data modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to code execution attempts.