---
id: "CVE-2026-111979"
kind: "vulnerability"
aliases: ["CVE-2026-111979"]
title: "GiveWP WordPress plugin: donation form setting enables stored script injection"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["givewp", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-custom-form-editing-role", "plugin-version-4.19.0.1-or-later"]
published_at: "2026-10-25T06:16:31+00:00"
first_seen_at: "2026-10-25T06:36:35+00:00"
updated_at: "2026-10-25T06:37:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111979", "first_seen_at": "2026-10-25T06:36:35+00:00"}]
---

# GiveWP WordPress plugin: donation form setting enables stored script injection

The GiveWP WordPress plugin before 4.19.0.1 does not escape a donation form template setting when it prints that value inside an HTML attribute. A user with the custom form-editing role can store a script that runs in the browser of any visitor or administrator who opens the affected donation form.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GiveWP version in the WordPress admin under Plugins, or with `wp plugin get give --field=version`
- Look for users with the custom form-editing role that GiveWP grants, and review donation form template settings for unexpected script content

## Fix

- Update the GiveWP plugin to `4.19.0.1` or later
- Review existing donation form template settings for injected script and remove any found

## Timeline

- 2026-10-25T06:36:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111979

## From the sources

The GiveWP  WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP  WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_