Live › vulnerability › CVE-2026-111979
Go to dashboardThe GiveWP WordPress plugin before 4.19.0.1 does not escape a donation form template setting when it prints that value inside an HTML attribute. A user with the custom form-editing role can store a script that runs in the browser of any visitor or administrator who opens the affected donation form.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 06:36 UTC. All times on this page are UTC.
Sites running the GiveWP plugin before 4.19.0.1 that let users with the custom form-editing role edit donation forms. Sites that run a current version, or that restrict form editing to fully trusted administrators, are much less exposed. Visitors to donation pages are only affected through a stored script placed by such a user.
No product ranges from the sources yet.
wp plugin get give --field=version4.19.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
This page as .md · .json · in your agent: get_signal("CVE-2026-111979")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.