CVE-2026-5510: GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and displaystyle shortcode attributes, which are passed through sanitizetextfield() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/GiveWP – Donation Plugin and Fundraising Platformto a version that resolves this vulnerability.Fixed in 4.14.4 - Compensating control
Mitigate by restricting the ability to create or edit content that can inject the vulnerable GiveWP 'give_form' shortcode attributes (e.g., limit Contributor+ permissions to the minimum needed) until patched.
Event History
Frequently Asked Questions
Which installations should be treated as affected?
GiveWP – Donation Plugin and Fundraising Platform versions up to and including 4.14.4 are affected. The provided data does not identify a fixed version.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated WordPress account with at least the Contributor role. They must be able to inject a give_form shortcode using the continue_button_title or display_style attributes into a page.
What happens after a malicious shortcode is saved?
Arbitrary script can be stored in the page and executes when a user accesses that injected page. The vulnerability can affect confidentiality and integrity, but no availability impact is indicated.
How can administrators look for possible exploitation?
Review pages and other content created or edited by Contributor-level and higher accounts for give_form shortcodes, especially those containing continue_button_title or display_style attributes. Treat unexpected attribute values or HTML-like payloads in those attributes as suspicious.