◆ CVE Hub

CVE-2026-111979

GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

Published
2026-10-25
Last modified
2026-10-25
CNA
WPScan
NVD status
Received
CWE
CWE-79
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed

Description

NVD

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownGiveWP
affected: 0 … < 4.19.0.1
default: unaffected

Linux distribution status

Red Hat ↗

Not tracked by this distribution.

Debian ↗

No record

Ubuntu ↗

Not tracked by this distribution.

References (1)