CVE-2026-85113: GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GiveWPto a version that resolves this vulnerability.Fixed in 4.16.9
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using the GiveWP WordPress plugin at a version earlier than 4.16.9 are affected if donor-supplied values are rendered on public pages. The impact depends on which shortcodes are registered on the site.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They need to submit a donor-controlled value containing nested shortcode syntax that bypasses GiveWP's shortcode stripping and is later rendered publicly.
Is there a workaround if updating is not immediately possible?
The provided information does not identify a workaround. Until GiveWP is updated, review publicly rendered donor-supplied content and the shortcodes registered on the site, since arbitrary registered shortcodes may be executed.