VULNERABILITY INTELLIGENCE

CVE-2026-111979

CVSS score6.8 MEDIUM

EPSS probability0.24%

CISA KEVNot currently listed

Published2026-10-25

Last modified2026-10-26

Description

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.