The vulnerability occurs when the GiveWP donation plugin fails to properly escape the continue_button_title and display_style attributes of the give_form shortcode. Because these attributes are passed through sanitize_text_field() but not escaped when they are output into HTML data attributes, an authenticated user with Contributor level or higher can inject arbitrary JavaScript that is stored on the site. When a victim views a page containing the shortcode, the injected script runs in the victim’s browser, enabling defacement, credential theft, or other client‑side attacks. The flaw is a classic stored cross‑site scripting weakness (CWE‑79).

The issue affects the GiveWP – Donation Plugin and Fundraising Platform from stellarwp, in all releases up to and including version 4.14.4. Users running these versions have the give_form shortcode available with the vulnerable attribute handling.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with at least Contributor privileges, which means the threat is limited to site owners or users who have been granted content management permissions. Still, because the payload is stored and automatically executed for any visitor to the affected page, the impact can be significant for websites with many contributors. Early detection is essential; if an attacker can inject malicious code, it will affect all users who view the compromised page.