Technical impact
The GiveWP WordPress plugin before version 4.19.0.1 fails to sanitize the primary color setting of a donation form template. When this value is output inside an HTML attribute, a malicious user can embed arbitrary JavaScript. The injected scripts run in the browser of anyone who opens the affected form, including visitors and site administrators. This allows attackers to steal session cookies, deface pages, or perform other client‑side actions that compromise user confidentiality and integrity.
Affected Systems
The vulnerability affects the GiveWP plugin for WordPress in all releases prior to 4.19.0.1. Affected users are those who have the custom form‑editing capability within the plugin. No specific operating system or web‑server version is listed, but the issue exists wherever the plugin is installed on a WordPress site.
Risk and Exploitability
The CVSS score for this vulnerability is 6.8, indicating a moderate severity. The EPSS score is listed as <1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the weakness is a classic stored XSS inside an HTML attribute and can be introduced by a user with custom form‑editing privileges. Once injected, any visitor to the affected donation form—including site administrators—will execute the malicious script in the user’s browser. The risk is therefore significant because the attacker can steal session cookies, deface pages, or carry out other client‑side attacks, even though the probability of exploitation appears low.
