CVE-2026-66690 Nexcess CVE debrief

Who should care

Administrators and users of GiveWP plugin versions <= 4.16.5 should be aware of this vulnerability and take necessary actions to update or mitigate the risk. This includes reviewing and applying patches from the vendor, monitoring for suspicious activity related to the GiveWP plugin, and ensuring that compensating controls are in place for exposed systems. Security teams and vulnerability management teams should prioritize updating GiveWP plugin versions to 4.16.6 or later.

Technical summary

CVE-2026-66690 is an unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP plugin versions <= 4.16.5. The vulnerability has a CVSS score of 7.1 and requires no user interaction (UI:R) to exploit. The attack vector is network (AV:N) with low complexity (AC:L) and no privileges (PR:N) required.

Defensive priority

Defenders should prioritize updating GiveWP plugin versions to 4.16.6 or later, as an unauthenticated Cross Site Scripting (XSS) vulnerability exists in GiveWP <= 4.16.5 versions.

Recommended defensive actions

• Update GiveWP plugin to version 4.16.6 or later
• Review and apply patches from the vendor
• Monitor for suspicious activity related to the GiveWP plugin

Evidence notes

The CVE-2026-66690 record indicates an unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP plugin versions <= 4.16.5. The CVSS score is 7.1, with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Limited evidence is available from official sources. Further verification is needed to confirm affected deployments and assess potential impact.

Official resources