CVE-2025-66533
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The GiveWP plugin by StellarWP is vulnerable to Code Injection in versions up to and including 4.13.1. The issue involves improper control of code generation, allowing code injection.
Risk Assessment
Risk of malicious code execution on the server, potentially leading to full compromise of the WordPress installation, data theft, or system damage.
Recommendation
Update the GiveWP plugin to the latest version if available. Immediately check file integrity and consider a security audit.
Other vulnerabilities in GiveWP
See all- CVE-2026-106600Medium
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.
- CVE-2026-97066Medium
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
- CVE-2026-96834Medium
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
- CVE-2026-96830High
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
- CVE-2026-5510Medium
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to and including 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-65464Medium
The GiveWP plugin version 4.16.3 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-82222Critical
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.
- CVE-2026-104672High
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
- CVE-2026-104405High
GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through <= 4.13.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS