Is CVE-2026-65441 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65441 being exploited in the wild.

How severe is CVE-2026-65441?

High severity, with a CVSS score of 7.1, published 27 July 2026.

Is there a fix for CVE-2026-65441?

A patch was published on 2026-07-27: Patch released in version 4.16.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65441 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65441?

Check whether you run StellarWP GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65441: Nexcess GiveWP unauthenticated XSS

CVE-2026-65441 · Severity: high · CVSS 7.1 · Published 2026-07-27

GiveWP is a popular WordPress plugin used by organizations to accept donations and manage fundraising campaigns. A security flaw allows an unauthenticated attacker to inject malicious scripts into the website, which could lead to the theft of sensitive donor information, unauthorized redirects to malicious sites, or the defacement of the donation platform. This could significantly damage an organization's reputation and compromise the security of its supporters.

Technologies: StellarWP GiveWP. Vendors: StellarWP.

Quick answers

Is CVE-2026-65441 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65441 being exploited in the wild.
How severe is CVE-2026-65441?: High severity, with a CVSS score of 7.1, published 27 July 2026.
Which products and versions are affected?: StellarWP GiveWP <= 4.16.3.
Is there a fix for CVE-2026-65441?: A patch was published on 2026-07-27: Patch released in version 4.16.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65441 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65441?: Check whether you run StellarWP GiveWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the GiveWP plugin for WordPress due to improper neutralization of input during web page generation (CWE-79). The flaw allows an unauthenticated remote attacker to inject arbitrary web scripts or HTML payloads. Exploitation requires a victim (typically a site administrator or visitor) to interact with a malicious link or crafted page. Successful exploitation can lead to session hijacking, unauthorized actions in the context of the victim's browser, or redirection to malicious domains. The issue is resolved in version 4.16.4.

Affected products

Nexcess / StellarWP GiveWP <= 4.16.3

Timeline

2026-07-03: other: Reported by researcher luc
2026-07-27: disclosed: Vulnerability disclosed by Patchstack
2026-07-27: patched: Patch released in version 4.16.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.