CVE-2026-85113
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
- State
- Published
- Severity
- 6.5 Medium
- Published
- Sep 21, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 3, 2026
Description
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | WPScan |
Weaknesses
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected Products
| Product | Versions |
|---|---|
GiveWPUnknown |
|
References
- https://wpscan.com/vulnerability/b092c718-9a29-4153-894f-47892e7ba423/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.