CyberRota Analysis
AI-GeneratedThe GiveWP plugin for WordPress, prior to version 4.16.3, is vulnerable due to improper escaping of donation-form template settings, which allows users with the GiveWP Worker role and higher to inject arbitrary web scripts into HTML attributes. This can lead to cross-site scripting (XSS) attacks, impacting the security of the public donation form and potentially compromising visitor data. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.