WordPress Plugin Vulnerabilities
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
Description
The plugin does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing plugin role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
Proof of Concept
Affects Plugins
Fixed in 4.19.0.1 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-23 (about 2 days ago)
Added
2026-10-23 (about 1 day ago)
Last Updated
2026-10-23 (about 1 day ago)
