GiveWP <=4.16.1 Authenticated Stored XSS Vulnerability (CVE-2026-13704) Advisory

Vulnerability Overview Vulnerability Name: GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequoia Form CVE ID: CVE-2026-13704 CVSS Score: 6.4 (Medium) Publication Date: July 1, 2026 Last Update Date: July 2, 2026 Researcher: Chita Catalin-Andrei (CC99E) - aisofe.io Impact Scope Affected Versions: GiveWP <= 4.16.1 Fixed Version: 4.16.2 Software Type: Plugin Software Slug: give (view on wordpress.org) Patch Status: Fixed Remediation Remediation Action: Upgrade to version 4.16.2 or later fixed versions Additional Information Vulnerability Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to stored cross-site scripting in all versions, up to and including 4.16.1, via the parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Give Worker-level permissions to execute arbitrary web scripts when a user accesses the injected page. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities Recent Vulnerability List: - GiveWP <= 4.15.3 - Cross-Site Request Forgery (CVE-2026-11981, CVSS 4.3, Researcher: jaxtoia, Date: June 30, 2026) - GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via block_id Shortcode Attribute (CVE-2026-13246, CVSS 6.4, Researcher: AmosRa, Date: June 30, 2026) - GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting (CVE-2025-42678, CVSS 7.2, Researcher: thevietronin, Date: May 16, 2026) - GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting (CVE-2025-34900, CVSS 6.1, Researcher: HuujiHD, Date: April 21, 2026) - GiveWP <= 4.14.5 - Missing Authorization (CVE-2025-42642, CVSS 5.3, Researcher: Bao - BlueRock, Date: March 2, 2026) - GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution (CVE-2025-66533, CVSS 6.5, Researcher: Kishan Vyas, Date: January 8, 2026) - GiveWP <= 4.13.1 - Cross-Site Request Forgery (CVE-2025-67467, CVSS 4.3, Researcher: Drew Webber (mcdriud), Date: December 23, 2025) - GiveWP – Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' (CVE-2025-13206, CVSS 7.2, Researcher: sharkly, Date: November 18, 2025) - GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure (CVE-2025-11227, CVSS 6.5, Researcher: Rafshanzani Suhada, Date: October 3, 2025) - GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association (CVE-2025-11228, CVSS 5.3, Researcher: Rafshanzani Suhada, Date: October 3, 2025) Other Resources Learn More: Learn More Get Wordfence: Get Wordfence Documentation: Documentation Contact Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour customer support, 365 days a year, with a 1-hour response time Legal Disclaimer Copyright: © 2012-2026 Defiant Inc. All rights reserved License: Released under the CC BY-SA 3.0 license Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Subscribe Subscribe: Sign Up Other Links Products: Products Support: Support News: News About: About Terms of Service: Terms of Service Privacy Policy: Privacy Policy Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Other Information Wordfence Intelligence: Wordfence Intelligence Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Other Resources Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support Blog: Blog News: In The News Vulnerability Advisories: Vulnerability Advisories About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe: Sign Up Terms of Service: Terms of Service Privacy Policy: Privacy Policy Other Information Subscribe:

Goal Reached Thanks to every supporter — we hit 100%!

GiveWP <=4.16.1 Authenticated Stored XSS Vulnerability (CVE-2026-13704) Advisory

More from this source