Code Injection Vulnerability in GiveWP by StellarWP
CVE-2025-66533

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
GiveWP
Vendor
CVE Published:
9 December 2025

What is CVE-2025-66533?

A vulnerability in the GiveWP plugin allows attackers to perform code injection attacks due to improper control over the generation of code. This results in the possibility for malicious users to execute arbitrary code within the context of the application. Versions from n/a up to and including 4.13.1 are affected, which can expose websites to significant security risks if not addressed.

Affected Version(s)

GiveWP 0 <= 4.13.1

References

https://patchstack.com/database/Wordpress/Plugin/give/vul...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kishan Vyas | Patchstack Bug Bounty Program
.