Code Injection Vulnerability in GiveWP by StellarWP
CVE-2025-66533

7.8HIGH

Key Information:

Vendor

WordPress
Status
GiveWP
Vendor
CVE Published:
9 December 2025

What is CVE-2025-66533?

A vulnerability in the GiveWP plugin allows attackers to perform code injection attacks due to improper control over the generation of code. This results in the possibility for malicious users to execute arbitrary code within the context of the application. Versions from n/a up to and including 4.13.1 are affected, which can expose websites to significant security risks if not addressed.

Affected Version(s)

GiveWP <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/give...
vdb-entry

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kishan Vyas | Patchstack Bug Bounty Program
JSON
.