# CVE-2026-111979: GiveWP WordPress plugin stored XSS in form template settings

Source: https://junglewise.ai/threats/cve-2026-111979-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-111979 · Severity: info · Published 2026-10-25

GiveWP is a WordPress plugin that enables nonprofit organizations to create and manage donation forms. A flaw in how the plugin handles donation form template settings allows users with form-editing permissions to inject malicious scripts that execute when administrators or donors view the affected donation forms, potentially leading to credential theft or unauthorized actions.

Technologies: [GiveWP](https://junglewise.ai/threats/technologies/givewp-givewp). Vendors: [GiveWP](https://junglewise.ai/threats/vendors/givewp).

## Quick answers

**Is CVE-2026-111979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111979 being exploited in the wild.

**How severe is CVE-2026-111979?** Informational severity, published 25 October 2026.

**Which products and versions are affected?** GiveWP before 4.19.0.1.

**Is there a fix for CVE-2026-111979?** Yes: fixed in 4.19.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111979 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-111979?** Check whether you run GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.19.0.1

## Technical details

The plugin fails to properly sanitize and escape form template settings (specifically the primary color field) before outputting them into HTML attributes, allowing stored cross-site scripting (XSS). An authenticated attacker with custom form-editing capabilities can inject arbitrary JavaScript that persists in the form configuration and executes in the context of any user viewing that form.

## Affected products

- GiveWP GiveWP before 4.19.0.1

## Timeline

- 2026-10-23: disclosed
- 2026-10-25: advisory

## References

- [https://wpscan.com/vulnerability/59b1b0ff-fbfb-4bb8-883e-94b5f2cee5a4/](https://wpscan.com/vulnerability/59b1b0ff-fbfb-4bb8-883e-94b5f2cee5a4/)

## Related threats

- [GiveWP WordPress plugin donation amount restriction bypass](https://junglewise.ai/threats/cve-2026-111974-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-restrict)
- [GiveWP WordPress plugin authorization bypass in page capability](https://junglewise.ai/threats/cve-2026-111980-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-correctly)
- [GiveWP WordPress plugin path traversal in settings import](https://junglewise.ai/threats/cve-2026-111978-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-properly)
- [GiveWP WordPress plugin unpublished donation form disclosure](https://junglewise.ai/threats/cve-2026-111976-the-givewp-wordpress-plugin-before-4-19-0-1-does-not-perform-any)
- [GiveWP Insecure Direct Object References](https://junglewise.ai/threats/cve-2026-97066-unauthenticated-insecure-direct-object-references-idor-in-givewp)