WordPress Plugin Vulnerabilities

GiveWP < 4.16.5.1 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
give
Fixed in 4.16.5.1

References

CVE
CVE-2026-66690
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/82ff0450-5a76-453e-bb27-45c11fff7419

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Abdullah Kareem "cyberkareem"
Verified
No
WPVDB ID
b6b8a9a8-8649-411c-950d-9318cc19a00d

Timeline

Publicly Published
2026-07-31 (about 2 months ago)
Added
2026-08-04 (about 2 months ago)
Last Updated
2026-08-04 (about 2 months ago)

Other

Published
Title
Published
2025-04-15
Title
WooMS <= 9.12 - Reflected Cross-Site Scripting
Published
2022-04-19
Title
Bulk Edit and Create User Profiles < 1.5.14 - Admin+ Stored Cross-Site Scripting
Published
2024-11-04
Title
WPForms < 1.9.1.6 - Admin+ Stored XSS
Published
2025-12-31
Title
Accessibility Press <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-03-16
Title
Table & Contact Form 7 Database – Tablesome < 1.0.28 - Reflected Cross-Site Scripting