GiveWP EUVD-2026-83868

Requires a WordPress site running GiveWP before 4.16.9 with a publicly accessible donation form (the default deployment). Exploitation is unauthenticated (PR:N) and needs no user interaction to inject; the attacker crafts nested shortcode delimiters specifically to defeat the plugin's stripping logic. The concrete LIMIT on impact is that meaningful damage depends on which shortcodes are registered on the target site - the flaw executes whatever shortcodes exist, so a site with only benign shortcodes suffers little, while one with sensitive/administrative shortcodes could see real data exposure or manipulation. Impact is realized only when the injected donor value is rendered on a public page viewed by others.

This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction - an easy trigger surface via public donation forms. However, the impact is deliberately bounded to Low confidentiality and Low integrity with no availability impact, reflecting that 'arbitrary shortcode execution' only carries real weight when a dangerous shortcode happens to be registered on the target site; it is NOT native code execution. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active or automated exploitation - the sole reference is a WPScan vulnerability entry. The 'RCE' tag in the input conflicts with the vendor's own C:L/I:L/A:N scoring and overstates real-world impact; treat it as shortcode/code injection whose severity is site-dependent, not confirmed remote code execution.

An unauthenticated attacker submits a donation (or fills a donor field) containing a nested shortcode payload crafted so the plugin's delimiter-stripping fails to remove the brackets. When the donor value is later rendered on a public page, WordPress parses and executes any shortcode the attacker embedded, running whatever functionality that shortcode exposes on the site. No public exploit code was identified at time of analysis, though the WPScan advisory documents the mechanism.