Executive brief
GiveWP is a popular WordPress plugin used by organizations to accept donations online. A security flaw in the plugin allows users with 'Worker' level access to inject malicious scripts into donation forms. When unsuspecting visitors view these forms, the scripts could execute in their browsers, potentially leading to data theft or unauthorized actions on the website.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in GiveWP versions prior to 4.16.3. The plugin fails to properly escape donation-form template settings, specifically the 'Submit Button' label in legacy form templates, before outputting them within HTML attributes. An attacker with the 'GiveWP Worker' role (or any role with 'edit_post' capabilities for forms) can inject a malicious payload into the 'checkout_label' parameter. When a visitor views the public donation form, the payload executes automatically (e.g., via 'autofocus' and 'onfocus' attributes). This issue is resolved in version 4.16.3.
Affected products
- GiveWP GiveWP < 4.16.3
Timeline
- 2026-07-10: disclosed
- 2026-07-30: advisory: NVD publication date
- 2026-07-10: patched