CVE-2026-111979
Received Received - Intake

Stored Cross-Site Scripting in GiveWP WordPress Plugin

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: WPScan

Description
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-111979
EUVD
EUVD-2026-109344

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown GiveWP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The GiveWP WordPress plugin before version 4.19.0.1 has a stored Cross-Site Scripting (XSS) vulnerability. It fails to properly sanitize and escape user input in the Form Template Primary Color setting. This allows users with custom form-editing roles to inject malicious scripts into donation forms. When visitors or administrators view the affected form, the injected scripts execute in their browsers.

Detection Guidance

Check the installed version of the GiveWP plugin using WordPress admin panel or run the command 'wp plugin list' in the WordPress directory. If the version is below 4.19.0.1, the system is vulnerable.

Impact Analysis

If you use the vulnerable GiveWP plugin version, attackers with custom form-editing roles could inject malicious scripts into your donation forms. These scripts could steal user data, session cookies, or perform actions on behalf of users. Visitors or administrators viewing the form could have their browsers compromised, leading to potential data breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive information. Under GDPR, this may result in fines for failing to protect user data. For HIPAA, if health-related data is compromised, it could violate compliance requirements. Organizations must address this to avoid legal and financial penalties.

Mitigation Strategies

Update the GiveWP plugin to version 4.19.0.1 or later immediately. If updating is not possible, disable the plugin until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart