The flaw occurs when a donation‑form template setting is rendered into an HTML attribute without escaping. A user with the GiveWP Worker role or higher can supply arbitrary script code, which then executes in the browsers of any visitor viewing the public donation form. This results in a stored XSS vulnerability on the site’s public donation pages.

The issue affects WordPress sites that have the GiveWP plugin installed in a version older than 4.16.3. The plugin is provided by an unnamed vendor (list: Unknown:GiveWP). Users with the GiveWP Worker role or elevated permissions can exploit this flaw. No specific WordPress core version information is included, but the vulnerability exists regardless of the version of WordPress itself as long as the vulnerable plugin is present.

The CVSS score of 6.8 indicates a moderate severity for a stored XSS. The EPSS score is less than 1%, suggesting that exploitation is unlikely at the present moment. The vulnerability is not listed in the CISA KEV catalog, further reducing operational urgency. The attack requires a user with the GiveWP Worker role or higher to inject content into the donation‑form template settings; such accounts must be trusted administrators. Any visitor viewing the affected donation form would be exposed to the injected script on load.