CVE-2026-82222

Critical10.0 Published on Aug 28, 2026

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.

Early warning: exploitation observed

Exploitation observed since Aug 31, 2026
Not yet in the official CISA catalogue
First attack observed 3 days after disclosure

Source: VulnCheck KEV · Aug 31, 2026

CVSS score10.0 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-502

Vulnerabilities

CVE-2026-82222: The Critical Vulnerability in GiveWP That Exposes WordPress to Command Execution

CVE-2026-82222: Critical GiveWP plugin flaw enables remote command execution on WordPress sites. Update to version 4.16.7.2 to fix.

Aug 30, 202603:15 4 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

CVE-2026-82222: The Critical Vulnerability in GiveWP That Exposes WordPress to Command Execution