GiveWP Worker accounts can store script in public donation forms
GiveWP before 4.16.3 lets a user assigned the GiveWP Worker role edit a legacy donation form because the template-settings path accepts current_user_can('edit_post', form_id). Attacker-controlled legacy[display_settings][checkout_label] data is saved as the form's submit-button label and rendered without attribute escaping in the public form's submit input, including its data-before-validation-label attribute. An attribute-breakout payload can therefore execute in the site origin when any visitor loads the affected donation form. The issue requires a legacy option-based donation form and an administrator-assigned GiveWP Worker or more privileged role.
- Component
- GiveWP
- Plugin slug
givewp- Affected
- < 4.16.3
- Safe version
4.16.3- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 29 known issues for this plugin.
Update, patch or deactivate.
Update GiveWP to 4.16.3 or later. Review legacy donation-form Submit Button labels for unexpected markup and remove malicious values before serving affected forms.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H