CVE-2026-118193
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The GiveWP plugin for WordPress in all versions up to and including 4.19.1 is vulnerable to Privilege Escalation via the donor_default_user_role parameter. The sanitize_option_donor_default_user_role() function applies only a narrow literal check against 'administrator' rather than enforcing the give_get_donor_safe_user_roles() allowlist, and the give_core_settings_import_callback() AJAX handler writes imported JSON directly into the give_settings option via update_option() without invoking the sanitize filter.
Risk Assessment
An authenticated attacker with the GiveWP Manager role or above can configure donor registration to assign privileged WordPress roles, up to and including Administrator via the import path, to every new donor account. This leads to full site takeover.
Recommendation
Update the GiveWP plugin to a version later than 4.19.1. Until patched, restrict the GiveWP Manager role to trusted users and disable JSON settings import from untrusted sources.
Other vulnerabilities in GiveWP
See all- CVE-2026-96333High
Authentication bypass by spoofing vulnerability in the GiveWP plugin. Affects versions from n/a through 4.16.8.1.
- CVE-2026-106600Medium
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.
- CVE-2026-97066Medium
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
- CVE-2026-96834Medium
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
- CVE-2026-96830High
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
- CVE-2026-5510Medium
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to and including 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-82222Critical
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.
- CVE-2026-116853Medium
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
- CVE-2026-104672High
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Original NVD description (English source)
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS