CVE-2025-66533: 
WordPress vulnerability analysis and mitigation

CVE-2025-66533 is a Code Injection (Content Injection) vulnerability in the StellarWP GiveWP WordPress plugin that allows unauthenticated attackers to inject arbitrary shortcodes into pages and posts. It affects GiveWP versions up to and including 4.13.1, with version 4.13.2 containing the fix. The vulnerability was reported by researcher Kishan Vyas on December 9, 2025, and publicly disclosed on January 8, 2026. The NVD assigns a CVSS v3.1 score of 7.8 (High), while Patchstack rates it 6.5 (Medium) under their WordPress-specific scoring methodology (Patchstack).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), specifically manifesting as an arbitrary shortcode execution flaw. Because WordPress shortcodes can invoke registered PHP functions, insufficient validation of user-supplied input allows unauthenticated requests to trigger shortcode rendering in page or post content. The attack vector is local per the NVD CVSS vector, though Patchstack characterizes the required privilege as "Unauthenticated," suggesting the local designation may reflect the WordPress execution context rather than requiring OS-level access. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a malicious actor to inject arbitrary content — including shortcodes that execute registered WordPress functions — into pages and posts of the affected website. This can be abused to embed phishing pages, redirect visitors to malicious sites, or manipulate site content for reputational or financial harm. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or traffic (Patchstack).

No confirmed in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.026% (0.000260), indicating a low current probability of exploitation in the near term. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack warns that this class of vulnerability is expected to be exploited and is frequently used in mass-exploit campaigns against WordPress plugins (Patchstack).

The vulnerability is patched in GiveWP version 4.13.2, released by StellarWP/Liquid Web. Site administrators should update the GiveWP plugin to version 4.13.2 or later immediately. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated, and auto-update for vulnerable plugins can be enabled via the Patchstack dashboard (Patchstack).

Wordfence included CVE-2025-66533 in their weekly WordPress vulnerability report covering January 5–11, 2026, and Sucuri referenced it in their January 2026 vulnerability patch roundup, indicating moderate coverage within the WordPress security community (Wordfence Blog, Sucuri Blog). No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.