CVE-2026-66690: WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

Affected Software

1 affected component

WordPress GiveWP plugin<=4.16.5

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress GiveWP plugin to a version that resolves this vulnerability.
Fixed in 4.16.5.1

Aug 6, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-66690 is high with a score of 7.1.

CVE-2026-66690 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting WordPress GiveWP plugin versions up to 4.16.5.

To fix CVE-2026-66690, update the GiveWP plugin to version 4.16.6 or later.

The impacts of CVE-2026-66690 include potential unauthorized script execution leading to a breach of user data.

Anyone using GiveWP plugin versions 4.16.5 or earlier on their WordPress sites is affected by CVE-2026-66690.