UNKNOWN NVD

CVE-2026-111979

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTM

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

References

https://wpscan.com/vulnerability/59b1b0ff-fbfb-4bb8-883e-94b5f2cee5a4/

Published: 2026-10-25 · Source: NVD · Feed updated: 2026-10-25

This unknown severity vulnerability was published on 2026-10-25 via NVD.

vulnfeed aggregates 17058 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.