{"id":"CVE-2026-111979","kind":"vulnerability","aliases":["CVE-2026-111979"],"related":[],"title":"GiveWP WordPress plugin: donation form setting enables stored script injection","description":"The GiveWP  WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP  WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.","summary":"The GiveWP WordPress plugin before 4.19.0.1 does not escape a donation form template setting when it prints that value inside an HTML attribute. A user with the custom form-editing role can store a script that runs in the browser of any visitor or administrator who opens the affected donation form.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["givewp","package","self-hosted","wordpress"],"not_affected_if":["no-custom-form-editing-role","plugin-version-4.19.0.1-or-later"],"how_to_check":"- Check the installed GiveWP version in the WordPress admin under Plugins, or with `wp plugin get give --field=version`\n- Look for users with the custom form-editing role that GiveWP grants, and review donation form template settings for unexpected script content","fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review existing donation form template settings for injected script and remove any found","status":"open","published_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","triaged_at":"2026-10-25T06:37:40+00:00","updated_at":"2026-10-25T06:37:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T06:37:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update the GiveWP plugin to `4.19.0.1` or later\n- Review existing donation form template settings for injected script and remove any found","reach":"internet","title":"GiveWP WordPress plugin: donation form setting enables stored script injection","impact":"medium","summary":"The GiveWP WordPress plugin before 4.19.0.1 does not escape a donation form template setting when it prints that value inside an HTML attribute. A user with the custom form-editing role can store a script that runs in the browser of any visitor or administrator who opens the affected donation form.","category":"package","nicknames":[],"who_cares":["wordpress","givewp","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Stored scripts run in visitor and administrator browsers on donation pages","analyst_note":"","how_to_check":"- Check the installed GiveWP version in the WordPress admin under Plugins, or with `wp plugin get give --field=version`\n- Look for users with the custom form-editing role that GiveWP grants, and review donation form template settings for unexpected script content","needs_analyst":false,"not_affected_if":["plugin-version-4.19.0.1-or-later","no-custom-form-editing-role"],"who_is_affected":"Sites running the GiveWP plugin before `4.19.0.1` that let users with the custom form-editing role edit donation forms. Sites that run a current version, or that restrict form editing to fully trusted administrators, are much less exposed. Visitors to donation pages are only affected through a stored script placed by such a user.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000621,"input_tokens":3347,"output_tokens":572,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111979':13A,16A '-2026':12A,15A '4.19.0.1':28B,80C,113C 'administr':68B,129C 'affect':72B,133C 'allow':101C 'arbitrari':117C 'attribut':45B,100C 'browser':63B,124C 'custom':50B,105C 'cve':11A,14A 'donat':4A,33B,73B,90C,134C 'edit':53B,108C 'enabl':7A 'escap':31B,86C 'execut':121C 'form':5A,34B,52B,74B,91C,107C,135C 'form-edit':51B,106C 'givewp':1A,17B,24B,76C,109C 'host':21B 'html':44B,99C 'inject':10A,116C 'insid':42B,97C 'one':87C 'open':70B,131C 'output':95C 'packag':18B 'plugin':3A,26B,78C,111C 'print':39B 'proper':83C 'role':54B,114C 'run':60B 'sanitis':84C 'script':9A,58B,119C 'self':20B 'self-host':19B 'set':6A,36B,93C 'store':8A,56B 'templat':35B,92C 'user':47B,102C 'valu':41B 'visitor':66B,127C 'web':118C 'wordpress':2A,22B,25B,77C,110C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GiveWP plugin before `4.19.0.1` that let users with the custom form-editing role edit donation forms. Sites that run a current version, or that restrict form editing to fully trusted administrators, are much less exposed. Visitors to donation pages are only affected through a stored script placed by such a user.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T06:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111979","severity":null,"published_at":"2026-10-25T06:16:31+00:00","modified_at":"2026-10-25T06:16:31+00:00","first_seen_at":"2026-10-25T06:36:35+00:00","fetched_at":"2026-10-25T06:36:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}