Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85113

GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85113

Published

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85113

Published

GiveWP

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "GiveWP",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "4.13.2",
                            "lessThan": "4.16.9"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON