CVE-2025-66533: WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.
Other sources
Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through <= 4.13.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress GiveWP pluginto a version that resolves this vulnerability.Fixed in 4.13.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66533?
CVE-2025-66533 is classified as a critical severity vulnerability due to its ability to allow code injection in affected versions of GiveWP.
How do I fix CVE-2025-66533?
To mitigate CVE-2025-66533, upgrade the GiveWP plugin to a version greater than 4.13.1.
Which versions of GiveWP are affected by CVE-2025-66533?
CVE-2025-66533 affects all GiveWP versions from n/a through 4.13.1.
What type of vulnerability is CVE-2025-66533?
CVE-2025-66533 is an improper control of generation of code vulnerability leading to code injection.
Can CVE-2025-66533 lead to remote code execution?
Yes, CVE-2025-66533 can potentially allow remote code execution due to its code injection capabilities.