The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into the pages served by the GiveWP WordPress plugin whenever a user visits a compromised form or donation page. The injected code runs in the victim’s browser, potentially compromising client confidentiality or integrity.

The flaw affects the Nexcess:GiveWP WordPress plugin versions 4.17.0 and earlier. Users running these editions on any WordPress installation are vulnerable until a patch is applied.

The CVSS score of 7.1 indicates moderate to high severity. Because the attack requires no authentication and can be triggered by any site visitor, the exploitability is high; the EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated web user visiting a page that renders the plugin’s output, making the risk significant for exposed sites.