CVE-2026-66690 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP versions up to 4.16.5. This vulnerability allows remote attackers to inject malicious scripts that execute in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability requires no privileges and has low attack complexity, but user interaction is required. The vulnerability affects the web interface and is classified under CWE-79.

Successful exploitation can lead to partial loss of confidentiality, integrity, and availability of the affected system. Because the vulnerability is unauthenticated, attackers do not need valid credentials to exploit it. The attack complexity is low, but user interaction is required, which may limit the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the vendor's announcements for updates and apply patches once available.