Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-07-02
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The GiveWP plugin for WordPress is vulnerable to a stored cross‑site scripting flaw through the sequoia[introduction][image] form sanitize and escape this input, allowing malicious JavaScript to be a visitor loads the affected form page. The weakness is classified as CWE‑79.

Affected Systems

All installations of the GiveWP plugin from stellarwp that are running any version up to and including 4.16.1 are affected. No information is available about whether versions beyond 4.16.1 contain the fix.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated users with Give Worker+ access; once they inject malicious scripts, those scripts run whenever any visitor accesses the affected form page.

Generated by OpenCVE AI on July 21, 2026 at 12:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the GiveWP plugin to a version newer than 4.16.1 to remove the vulnerable code path.
  • If an update cannot be applied immediately, remove or deactivate the Sequoia form template so that the sequoia[introduction][image] field is no longer used.
  • Add server‑side input validation and output filtering for the sequoia[introduction][image] parameter, ensuring that any stored content is escaped according to CWE‑79 best practices.
  • Limit Give Worker+ permissions to trusted administrators or otherwise tighten role‑based access controls so that only authorized users can edit forms.

Generated by OpenCVE AI on July 21, 2026 at 12:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-02T12:35:05.389Z

Reserved: 2026-06-29T13:16:34.616Z

Link: CVE-2026-13704

cve-icon Vulnrichment

Updated: 2026-07-02T12:34:59.419Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:30:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')