The vulnerability is an unauthenticated XSS flaw in the GiveWP WordPress plugin versions up to 4.16.9. An attacker can inject malicious scripts that will run in the context of any visitor who views the affected pages, potentially allowing theft of session cookies, credential hijacking, defacement of the site’s content, or the execution of further client‑side attacks. The weakness is classified as CWE‑79, a classic input validation error that permits malicious code injection.

All installations of the GiveWP plugin version 4.16.9 or earlier, developed by Nexcess and marketed as GiveWP. The plugin is part of a standard WordPress deployment and can be found in any WordPress site that imports or updates this plugin through the plugin repository.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely web‑based and does not require prior authentication, meaning any visitor to the vulnerable WordPress site could be impacted. An attacker may exploit the flaw by entering crafted payloads into plugin configuration fields or related input locations, with no additional system permissions or preconditions required.