by All
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.
CVSS Score
6.4
MEDIUM
Published
16 Jul 2026 04:17
Modified
16 Jul 2026 14:16
Vendor
All
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Complexity
Low
Privileges
Low
Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Weaknesses (CWE)
CWE-79
References
plugins.trac.wordpress.org
/browser/give/tags/4.14.5/includes/admin/forms/class-metabox-form-data.php
plugins.trac.wordpress.org
/browser/give/tags/4.14.5/includes/formatting.php
plugins.trac.wordpress.org
/browser/give/tags/4.14.5/src/Views/Form/Templates/Sequoia/views/social-sharing.php
plugins.trac.wordpress.org
/browser/give/tags/4.15.5/includes/admin/forms/class-metabox-form-data.php
plugins.trac.wordpress.org
/browser/give/tags/4.15.5/includes/formatting.php
plugins.trac.wordpress.org
/browser/give/tags/4.15.5/src/Views/Form/Templates/Sequoia/views/social-sharing.php
plugins.trac.wordpress.org
/changeset
www.wordfence.com
/threat-intel/vulnerabilities/id/bdd0ba4b-56f1-4f4b-95f7-28c911c8de09