What is the CVSS score of CVE-2026-13246?

CVE-2026-13246 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

GiveWP CVE-2026-13246

EUVD-2026-40888 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-mv65-r2jq-jh8q

WordPress XSS Wordpress Plugin Givewp Donation Plugin And Fundraising Platform Stellarwp

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Author-level authentication (PR:L) is required; stored payload executes on any visitor without further attacker action (UI:N); scope change (S:C) reflects cross-user browser impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:29 vuln.today

CVE Published

Jul 01, 2026 - 03:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in GiveWP versions up to and including 4.16.0 allows authenticated attackers with author-level WordPress access to inject persistent JavaScript payloads via the 'block_id' attribute of the 'givewp_campaign_comments' shortcode. The flaw originates in two code paths - CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() - where the blockId value is interpolated directly into a single-quoted HTML attribute without WordPress's esc_attr() sanitization function. Any visitor loading an injected page will have the malicious script execute in their browser context. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

GiveWP is a WordPress donation and fundraising plugin developed by StellarWP (CPE: cpe:2.3:a:stellarwp:givewp_-_donation_plugin_and_fundraising_platform:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The vulnerability exists in the Campaigns feature, specifically in two classes: CampaignCommentsShortcode (plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17 and #L78) and BlockRenderController (plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23). The shortcode is registered via RegisterCampaignShortcodes and rendered through render.php. WordPress provides the esc_attr() function precisely to neutralize attribute-context injection, but the blockId value bypasses this filter entirely, making the single-quoted HTML attribute boundary breakable with a crafted attribute payload.

RemediationAI

A fix is available via WordPress plugin Trac changeset 3590193 (https://plugins.trac.wordpress.org/changeset?old=3590193%40give&new=3590193%40give), which represents an upstream code correction. The exact released version number containing this fix is not confirmed in the available reference data; administrators should update GiveWP to the latest version available in the WordPress Plugin Directory and verify the installed version exceeds 4.16.0. As a compensating control while patching, restrict WordPress author-level and above roles to fully trusted users only, since the vulnerability requires an authenticated session at that privilege level. Additionally, a Web Application Firewall rule blocking attribute-breaking characters (single quotes, angle brackets) in shortcode parameters can reduce exploitation risk but may interfere with legitimate shortcode use. Disabling the Campaigns feature entirely, if not operationally required, eliminates the vulnerable code path with no impact to core donation functionality.