CVE-2026-104404: WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress GiveWP pluginto a version that resolves this vulnerability.Fixed in 4.18.0
Event History
Frequently Asked Questions
What access and conditions are required for exploitation?
The CVSS vector indicates that exploitation is network-accessible and low complexity, but requires low-level privileges and user interaction. The issue is stored XSS, so exploitation involves malicious content being stored and later rendered to an interacting user.
Which GiveWP installations are within the affected version range?
GiveWP versions through 4.17.0 are affected. The available data does not specify a lower affected version boundary.
What impact should be expected if the issue is exploited?
The CVSS assessment assigns low impact to confidentiality, integrity, and availability, with scope changed. The severity is rated medium at 6.5.