CVE-2026-85530
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalize a donor's e-mail address between the value it stores and the value it later uses to look that donor up. This allows unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
Risk Assessment
The organization is exposed to admin account takeover through email address manipulation, which could lead to full compromise of the WordPress system and donor data.
Recommendation
It is recommended to immediately update the GiveWP plugin to version 4.16.8.1 or later, which introduces consistent email normalization.
Other vulnerabilities in GiveWP
See all- CVE-2026-96333High
Authentication bypass by spoofing vulnerability in the GiveWP plugin. Affects versions from n/a through 4.16.8.1.
- CVE-2026-106600Medium
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.
- CVE-2026-97066Medium
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
- CVE-2026-96834Medium
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
- CVE-2026-96830High
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
- CVE-2026-5510Medium
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to and including 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-82222Critical
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.
- CVE-2026-116853Medium
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
- CVE-2026-104672High
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Original NVD description (English source)
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS