CVE-2026-65441 in GiveWP Plugin
Summary
by MITRE • 07/28/2026
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability under discussion represents an unauthenticated cross site scripting flaw affecting GiveWP versions up to and including 4.16.3, which constitutes a critical security weakness in the widely used WordPress donation plugin. This vulnerability allows attackers to inject malicious scripts into web pages viewed by users without requiring any authentication credentials or privileged access. The flaw exists within the plugin's handling of user input and output rendering processes, creating an opportunity for attackers to execute arbitrary JavaScript code in the context of a victim's browser session.
The technical nature of this vulnerability stems from insufficient input validation and output sanitization mechanisms within GiveWP's core functionality. When users interact with donation forms or administrative interfaces, the plugin fails to properly escape or filter potentially malicious content that could be submitted through various input fields. This weakness creates a persistent cross site scripting vector that can be exploited by attackers who craft specially crafted payloads designed to bypass the platform's security measures. The vulnerability specifically affects how the plugin processes and displays user-generated content, particularly in donation forms and related administrative sections.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to perform a wide range of malicious activities including session hijacking, credential theft, data exfiltration, and redirection to malicious websites. An attacker could leverage this vulnerability to steal administrator credentials, modify donation records, manipulate fundraising campaigns, or even compromise the entire WordPress installation through subsequent attacks. The unauthenticated nature of the exploit means that any visitor to a vulnerable website could potentially be targeted, making this vulnerability particularly dangerous for organizations relying on GiveWP for their charitable giving platforms. Organizations with high traffic volumes or those handling sensitive donor information face heightened risk exposure from this vulnerability.
Mitigation strategies should focus on immediate plugin updates to versions 4.16.4 and later, which contain patches addressing the XSS vulnerability through improved input validation and output sanitization routines. Administrators should also implement additional security measures including web application firewalls, content security policies, and regular security audits of their WordPress installations. The vulnerability aligns with CWE-79 which specifically addresses cross site scripting flaws in software applications, and maps to ATT&CK technique T1059.007 for script execution through web interfaces. Organizations should conduct thorough penetration testing to verify the effectiveness of their mitigations and monitor for any signs of exploitation attempts in their web server logs or application monitoring systems.