CVE-2026-111979 GiveWP CVE debrief

Who should care

Defenders responsible for WordPress installations using the GiveWP plugin, particularly those with custom form templates, should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

CVE-2026-111979 is a vulnerability in the GiveWP WordPress plugin that allows for XSS attacks via custom form templates. Defenders should prioritize updates and review custom templates to mitigate this risk.

• Potential for XSS attacks on users viewing affected donation forms
• Risk of arbitrary web script execution in the browser
• Need for prompt updates to plugin version 4.19.0.1 or later
• Importance of reviewing custom form templates for sanitization

Technical summary

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitize and escape donation form template settings, allowing users with a custom form-editing role to inject arbitrary web scripts. These scripts can execute in the browser of any visitor or administrator who opens the affected donation form. The vulnerability arises from improper sanitization and escaping of user-input data in custom form templates, and its impact includes potential XSS attacks on users viewing affected donation forms. Defenders should prioritize updating the GiveWP plugin to version 4.19.0.1 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize updating the GiveWP plugin to version 4.19.0.1 or later to mitigate this vulnerability. Additionally, reviewing and sanitizing user-input data in custom form templates is crucial.

Recommended defensive actions

• Update GiveWP plugin to version 4.19.0.1 or later
• Review and sanitize user-input data in custom form templates
• Monitor for suspicious activity on donation forms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by WPScan, and the CVE record is based on information from the NVD and CVE Program. However, details on exploitation, impact, and remediation are limited. The CVE record was published on 2026-10-25T06:16:31.387Z and has not been modified since then. The source details are limited, and defenders should verify the affected scope and severity based on the official advisory. The vulnerability allows for XSS attacks via custom form templates, and defenders should review custom templates to mitigate this risk.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.