CVE-2026-5510 in GiveWP Plugin
Summary
by MITRE • 08/28/2026
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The GiveWP plugin serves as a widely utilized donation and fundraising platform within the WordPress ecosystem, enabling organizations and individuals to collect contributions through customizable forms. A critical security flaw has been identified in versions up to 4.14.4 involving stored cross-site scripting vulnerabilities associated with the give_form shortcode. This vulnerability stems from insufficient input sanitization and output escaping mechanisms applied specifically to the continue_button_title and display_style attributes of the shortcode. While these inputs are processed through sanitize_text_field, a function that strips HTML tags but does not prevent all forms of malicious code injection in certain contexts, they fail to undergo proper escaping when rendered within HTML data attributes. This gap allows attackers with Contributor-level access or higher privileges to inject arbitrary web scripts into donation form configurations.
The technical nature of this flaw classifies it under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. The vulnerability is categorized as stored because the malicious script payload is saved within the application's database via the shortcode attributes rather than being reflected directly in a single request. When an administrator or contributor with sufficient privileges configures a donation form, they can embed JavaScript code into the continue_button_title attribute. Since this value is outputted without adequate escaping for HTML data contexts, the browser interprets and executes the injected script whenever the page containing the shortcode is loaded by any user. This execution occurs in the context of the victim's session, potentially allowing attackers to hijack administrative sessions, steal sensitive cookies, or perform actions on behalf of authenticated users.
From an operational perspective, this vulnerability poses a significant risk to organizations relying on GiveWP for fundraising activities. An attacker with Contributor-level access can persistently embed malicious code that affects all visitors viewing the donation page. This could lead to data exfiltration, defacement of the site, or redirection of donors to phishing sites designed to capture financial information. The impact is amplified by the fact that many WordPress installations grant contributor roles to multiple users for content management purposes, increasing the attack surface. Furthermore, because the script executes upon page load, it can operate silently without immediate detection by end-users, allowing prolonged unauthorized access or data theft before remediation occurs.
Mitigation strategies should prioritize immediate updates and enhanced input validation practices. Users of GiveWP versions up to 4.14.4 are strongly advised to upgrade to the latest patched version where proper escaping functions such as esc_attr have been implemented for HTML data attributes. In addition to updating, administrators should enforce strict role-based access control principles by limiting contributor-level privileges only to trusted individuals who require content editing capabilities. Implementing a Web Application Firewall can also provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Security audits focusing on output encoding across all shortcode attributes are recommended to prevent similar vulnerabilities in other plugins or custom code within the WordPress environment.
This incident highlights the importance of adhering to secure coding standards such as those outlined in OWASP guidelines for preventing cross-site scripting attacks. Developers must ensure that all user-controlled data is treated as untrusted and undergoes appropriate context-specific encoding before being rendered in HTML, JavaScript, CSS, or URL contexts. For organizations using WordPress, maintaining up-to-date software components and regularly reviewing plugin code for proper sanitization and escaping practices are essential steps toward securing digital assets against evolving cyber threats.