EUVD-2026-96109
GHSA-rx8r-4hqr-25gw
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate-severity, realistically lower-priority stored XSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4) shows network reach with low attack complexity but requires authenticated access at Contributor level or above (PR:L), which materially limits the attacker population to users who already hold a trusted site role. No EPSS score, KEV listing, or public POC is present in the provided data, so the exploitation signal is: no public exploit identified at time of analysis. The flaw is technically well-characterized by Wordfence (a credible source) with a precise root cause - json_encode($attributes) emitted inside a single-quoted HTML attribute without esc_attr(), and json_encode() not escaping single quotes - so the vulnerability itself is confirmed, but there is no evidence of widespread or active exploitation. Net: a real, valid issue worth patching, but not an emergency; the PR:L requirement and absence of KEV/EPSS/POC signals point to opportunistic or insider-style abuse rather than mass exploitation. Two caveats to verify: EPSS is simply not supplied here (absence is not a low score), and UI:N is the Wordfence convention for stored XSS that auto-fires on page view - confirm whether your threat model agrees victim interaction is truly zero. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Stored cross-site scripting in the GiveWP donation and fundraising plugin for WordPress (versions up to and including 4.17.0) lets authenticated attackers with Contributor-level access or above plant arbitrary JavaScript through the givewp_campaign_grid shortcode's attributes, which is then rendered unsanitized into any page or preview that loads the affected content. Exploitation requires a low-privileged account able to submit shortcode-bearing content and a higher-privileged or public visitor to view it, which is why it rates only moderate (CVSS 6.4, scope-changed C:L/I:L) and is a realistically lower-priority issue; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing). The primary impact is session/token theft or privileged action abuse against the viewing user rather than site-wide compromise.
RemediationAI
Vendor-released patch: 4.18.0 - upgrade GiveWP through the WordPress plugin dashboard or from github.com/impress-org/givewp/releases/tag/4.18.0 to eliminate the unsanitized shortcode attribute path (the release notes do not itemize the XSS fix, so treat the version reference as the remediation baseline and verify the patched file after updating). If an immediate upgrade is not possible, the most effective compensating control is to disable rendering of the affected shortcode - remove or filter the givewp_campaign_grid shortcode registration in src/Campaigns/Actions/RegisterCampaignShortcodes.php or strip it from post content at render time - at the cost of losing the campaign grid display on the site. As a second layer, tighten who can inject shortcode HTML: restrict or remove Contributor-level accounts on donor-facing sites and force moderation/review of all submissions containing shortcodes, accepting that this adds editorial overhead and does not remove the flaw itself. Deploying a Content Security Policy that disallows inline script reduces the impact of any stored payload in supported browsers, but may break legitimate GiveWP front-end scripts. Site owners should also review existing posts, drafts and pending submissions for givewp_campaign_grid usage containing quotes or script-like values and purge them, since the payload persists in the database. Vendor advisory and patch metadata are available at https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=cve.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / stored XSS) in GiveWP's campaign grid shortcode pipeline. WordPress shortcodes accept arbitrary HTML-style attributes, and CampaignGridShortcode::parseAttributes() (plugins.trac.wordpress.org/.../Campaigns/Shortcodes/CampaignGridShortcode.php, lines 22 and 91) passes user-supplied values for filter_by, layout, sort_by and order_by forward without adequate sanitization or output escaping. The registration path (RegisterCampaignShortcodes.php line 28) and render controller (ShortcodeRenderController.php line 65) hand those attributes to the template at Campaigns/Blocks/CampaignGrid/render.php line 6, which emits json_encode($attributes) directly inside a single-quoted HTML attribute. PHP's json_encode() does not escape single quotes unless the JSON_HEX_APOS flag is set, so a single apostrophe in any attribute value terminates the enclosing attribute and lets an attacker inject additional markup and a script context. The correct fix pattern is esc_attr() on output (or JSON_HEX_APOS on the encoding) applied to the serialized attribute payload; the affected component is the GiveWP plugin (CPE cpe:2.3:a:stellarwp:givewp_-_donation_plugin_and_fundraising_platform) maintained by StellarWP. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms a network-reachable, low-complexity defect requiring a low-privileged authenticated account, with scope change reflecting that the injected script executes in the context of a victim's browser session rather than the attacker's own content.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's givewp_campaign_grid shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (filter_by, layout, sort_by, order_by) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting json_encode($attributes) inside a single-quoted HTML attribute without esc_attr() - json_encode() does not escape single quotes by default, so a ' in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB