WordPress Plugin Vulnerabilities

GiveWP < 4.16.4 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape some data before outputting it back in a page, leading to a Stored Cross-Site Scripting vulnerability which can be exploited by unauthenticated attackers to inject arbitrary web scripts that will execute when a user views the affected page.

Affects Plugins

Plugin icon
give
Fixed in 4.16.4

References

CVE
CVE-2026-65441
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/8a106ebb-f3ec-4995-9717-358b91d468b4

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
luc
Verified
No
WPVDB ID
7d1a9385-333e-483e-b762-a71849a9d6f7

Timeline

Publicly Published
2026-07-27 (about 2 months ago)
Added
2026-07-30 (about 2 months ago)
Last Updated
2026-07-30 (about 2 months ago)

Other

Published
Title
Published
2025-04-04
Title
Xpro Elementor Addons < 1.4.11 - Contributor+ Stored XSS
Published
2025-10-19
Title
Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2020-06-03
Title
Newspaper < 10.3.4 - Authenticated Reflected Cross-Site Scripting
Published
2024-05-07
Title
Gold Addons for Elementor < 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-05-26
Title
Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS