GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Grid Shortcode and Campaign Block Attributes
- ID
- WPSEC-2026-0359
- Plugin
- GiveWP – Donation Plugin and Fundraising Platform (give)
- Affected
- from 4.0.0 before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- GiveWP – Donation Plugin and Fundraising Platform on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-97643, on 2026-10-09.
Description
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the givewp_campaign_grid shortcode attributes and the attributes of the Campaign and Campaign Grid blocks in versions 4.0.0 up to, and including, 4.17.0. This is due to insufficient input sanitization and output escaping: the block render templates printed json_encode() of the attributes into an unquoted (Campaign) or single-quoted (Campaign Grid) HTML attribute without esc_attr(), and json_encode() escapes neither spaces nor single quotes, while the shortcode passed layout, sort_by, order_by and filter_by through unvalidated. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
- https://wpsec.com/vuln/WPSEC-2026-0359/
- https://plugins.svn.wordpress.org/give/tags/4.18.0/
- https://wordpress.org/plugins/give/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS