Cross-Site Scripting Vulnerability in GiveWP WordPress Plugin
CVE-2026-111979
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111979?
The GiveWP plugin for WordPress prior to version 4.19.0.1 allows for improper sanitization and escaping of donation form template settings. This oversight can be exploited by users with specific roles who can modify form settings, permitting the injection of arbitrary scripts. Consequently, these scripts can execute in the web browsers of any visitors or administrators viewing the compromised donation form, raising significant security concerns.
Affected Version(s)
GiveWP 0 < 4.19.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.