CVE-2026-85113 in GiveWP Plugin
Summary
by MITRE • 09/21/2026
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in GiveWP versions prior to 4.16.9 represents a significant security flaw within one of the most widely used donation plugins for WordPress environments. This issue stems from an improper handling of user-supplied input, specifically donor-provided values that are intended to be displayed on public-facing pages such as donation receipts or confirmation screens. The core technical failure lies in the plugin's sanitization logic, which attempts to strip shortcode delimiters like square brackets from these inputs before rendering them. However, this stripping mechanism is flawed because it fails to account for nested structures. An attacker can exploit this by nesting shortcodes within one another, effectively bypassing the single-pass removal of delimiter characters. This allows arbitrary shortcodes registered on the WordPress site to be executed rather than being displayed as plain text or safely escaped content.
From a technical perspective, this vulnerability is classified under CWE-79, which covers Cross-Site Scripting (XSS), specifically in cases where input validation and output encoding are insufficiently robust against obfuscation techniques like nesting. The attack vector allows unauthenticated users to interact with the application by submitting malicious payloads through donation forms or related input fields. Because WordPress plugins often register shortcodes that can trigger complex backend logic, execute database queries, or access sensitive functions, the ability to inject and execute arbitrary shortcodes elevates this from a simple XSS issue to a potential Remote Code Execution (RCE) scenario depending on which specific shortcode is exploited. The lack of authentication required for exploitation makes it particularly dangerous in public-facing donation portals where any visitor can submit data.
The operational impact of this vulnerability extends beyond immediate script execution. If an attacker successfully exploits the nested shortcode injection, they could potentially access sensitive site configurations, exfiltrate database information, or perform actions on behalf of authenticated users if session cookies are accessible via the executed context. This compromises the integrity and confidentiality of the WordPress installation. Furthermore, since GiveWP handles financial transactions, any compromise that disrupts the donation flow or alters transaction records can have direct business implications for organizations relying on this platform for fundraising. The vulnerability undermines trust in the security posture of websites using affected versions, potentially leading to reputational damage and loss of donor confidence.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running GiveWP should upgrade to version 4.16.9 or later, where the shortcode stripping logic has been hardened to properly handle nested delimiters and ensure that user-supplied data is correctly sanitized before rendering. In addition to updating, organizations should implement a Web Application Firewall (WAF) configured with rulesets aligned with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1190 Exploit Public-Facing Application to detect and block malicious shortcode injection attempts at the network perimeter. Regular security audits and code reviews focusing on input validation and output encoding practices are also recommended to prevent similar vulnerabilities in custom plugins or themes that may employ analogous logic patterns.