The vulnerability is an unauthenticated reflected cross‑site scripting flaw in the GiveWP donation plugin on WordPress sites. It allows an attacker to embed malicious JavaScript into a page that is rendered by the plugin, potentially stealing session data, defacing the site or redirecting users to malicious sites. The weakness corresponds to CWE‑79 and can be exploited by any user who can access the vulnerable page.

WordPress websites that incorporate the GiveWP donation plugin version 4.14.2 or earlier. The affected product, provided by Liquid Web / StellarWP, is the GiveWP plugin and any installation running a version up to and including 4.14.2.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is less than 1 %, suggesting current exploitation activity is low, and the flaw is not listed in the CISA KEV catalog. Nevertheless, because the vector is unauthenticated and the attack can be performed via a crafted link or embedded form, the risk remains significant. An attacker can execute JavaScript in the victim’s browser, potentially hijacking their session or defacing content.