The GiveWP Donation Plugin for WordPress allows an authenticated user with worker‑level or higher permissions to embed unsanitized JavaScript into donor notes. When a page that renders the note is subsequently visited, the script executes in the victim’s browser, potentially enabling client‑side attacks. The vulnerability arises from insufficient input sanitization and output escaping, as documented in the plugin code. Since the code improvement is not explicitly mentioned, the effect is limited to script execution rather than other exploit outcomes.

WordPress sites utilizing GiveWP version 4.5.0 or earlier are affected. Any installation that includes the plugin and grants a user GiveWP worker or higher role can exploit the flaw, provided legacy functionality is enabled. Sites that have removed the plugin or disabled legacy mode are not impacted.

The CVSS score of 5.4 classifies the flaw as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to first authenticate to the WordPress admin area, inject a malicious note, and subsequently persuade an administrator to visit a page that renders the legacy interface. If achieved, the injected script runs in the victim’s browser, providing the attacker with client‑side control.