The vulnerability allows an unauthenticated attacker to store arbitrary JavaScript code in the donor name field of the GiveWP plugin. Once stored, the code executes in a user’s browser whenever the affected page is displayed. The flaw stems from insufficient input sanitization and output escaping for the ‘name’ parameter, and it can be exploited only when avatars are enabled in the WordPress installation.

GiveWP – Donation Plugin and Fundraising Platform, a WordPress plugin packaged by StellarWP, is impacted in all releases up to and including 4.13.0. Any WordPress site running these versions with avatars enabled is susceptible.

The CVSS score of 7.2 indicates a moderate to high severity. The EPSS score of less than 1% suggests a very low probability of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves submitting a crafted donor name through the public form; because the attack is unauthenticated, site administrators must take defensive measures even before a potential attacker can gain access.