CVE-2026-65441: GiveWP Cross-Site Scripting Vulnerability

CVE-2026-65441 Overview

CVE-2026-65441 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the GiveWP WordPress donation plugin in versions up to and including 4.16.3. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker can inject script content that executes in a victim's browser when the victim interacts with a crafted request or link. Successful exploitation can lead to session compromise, credential theft, or unauthorized actions performed in the context of the affected user. The vulnerability requires user interaction and operates across a security boundary, allowing impact to extend beyond the vulnerable component.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who interacts with a crafted request, potentially compromising WordPress administrator sessions on sites running GiveWP <= 4.16.3.

Affected Products

GiveWP WordPress plugin versions <= 4.16.3
WordPress sites using the GiveWP donation plugin for fundraising
Any downstream deployment bundling vulnerable GiveWP releases

Discovery Timeline

2026-07-27 - CVE-2026-65441 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-65441

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting (XSS) flaw in the GiveWP plugin. Attacker-controlled input is reflected or rendered in a page context without sufficient output encoding or input sanitization. Because the issue does not require authentication, any anonymous visitor can craft a malicious payload and deliver it to a target user. When the target renders the affected page, the injected script executes in their browser under the origin of the WordPress site.

The scoped impact indicates that a successful payload can affect resources outside the vulnerable component. On WordPress sites, this typically translates to actions taken against the administrative interface once a logged-in administrator triggers the payload. The Exploit Prediction Scoring System (EPSS) rates the vulnerability at 0.146%, placing it in the 4.363 percentile at time of publication.

Root Cause

The root cause is improper neutralization of user-supplied input before it is written into HTML output generated by the GiveWP plugin. The plugin fails to apply sufficient contextual escaping or sanitization, allowing HTML and JavaScript tokens supplied by an unauthenticated source to reach the rendered response. This maps directly to [CWE-79].

Attack Vector

Exploitation is network-based and requires user interaction. An attacker crafts a URL or request containing a JavaScript payload targeting a vulnerable GiveWP endpoint. The attacker delivers this URL to a victim through phishing, forum posts, or embedded links. When the victim visits the link on a site running GiveWP <= 4.16.3, the payload executes in the victim's browser. If the victim is a WordPress administrator, the attacker can leverage the session to modify plugin settings, create rogue accounts, or plant persistent backdoors. Refer to the Patchstack Vulnerability Advisory for advisory details.

Detection Methods for CVE-2026-65441

Indicators of Compromise

Web server access logs containing requests to GiveWP endpoints with <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E) in query strings or POST bodies
Unexpected WordPress administrator account creation or plugin/theme modifications following user visits to GiveWP-related URLs
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after visiting donation or campaign pages

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns targeting GiveWP endpoints and query parameters
Correlate WordPress audit logs with web access logs to identify administrative actions immediately following requests containing script tokens
Inventory installed WordPress plugins and alert on any GiveWP installation at version <= 4.16.3

Monitoring Recommendations

Monitor Content Security Policy (CSP) violation reports for inline script executions originating from GiveWP pages
Track administrator session activity, including new user creation, role changes, and plugin installations for anomalies
Alert on outbound HTTP requests from WordPress hosts to newly registered or low-reputation domains

How to Mitigate CVE-2026-65441

Immediate Actions Required

Update the GiveWP plugin to a version newer than 4.16.3 as soon as a patched release is available from the vendor
Audit WordPress administrator accounts and revoke sessions for privileged users who may have interacted with attacker-supplied links
Restrict administrative access to WordPress by IP allowlist or VPN while a patched version is being validated

Patch Information

Consult the Patchstack Vulnerability Advisory for the current fixed version and vendor guidance. Apply the patched GiveWP release across all WordPress installations and confirm the plugin version through the WordPress plugin management interface after upgrade.

Workarounds

Deploy a WAF ruleset that blocks requests containing common XSS payload patterns targeting GiveWP routes
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Temporarily disable the GiveWP plugin on sites that do not require active donation functionality until an upgrade is applied

bash

# Example WordPress CLI check for vulnerable GiveWP versions
wp plugin get give --field=version
wp plugin update give