Executive brief
GiveWP is a WordPress plugin that manages charitable donations on websites. The plugin fails to properly sanitize donor-supplied data before displaying it publicly, allowing unauthenticated attackers to inject and execute arbitrary shortcodes (embedded WordPress commands) on affected sites. This could enable attackers to modify site content, steal data, or create additional security vulnerabilities.
Technical details
The vulnerability is a shortcode injection flaw in GiveWP versions before 4.16.9. Donor-supplied values (such as donor names) are rendered on public pages without removing shortcode delimiters, and the plugin's shortcode stripping mechanism can be bypassed through nested shortcode syntax. An unauthenticated attacker can craft a malicious donation with specially formatted shortcode syntax in the donor name field to execute arbitrary registered shortcodes on the site.
Affected products
- Give GiveWP before 4.16.9
Timeline
- 2026-09-18: disclosed
- 2026-09-21: patched: Version 4.16.9 released