Security Alert Summary
The GiveWP – Donation Plugin and Fundraising Platform contains a stored cross-site scripting (XSS) vulnerability in the give_form shortcode. Insufficient output escaping of the continue_button_title and display_style shortcode attributes allows authenticated users with Contributor-level access or higher to inject scripts that execute when an affected page is viewed.
CVE Details
- CVE ID:
CVE-2026-5510 - Affected component: GiveWP – Donation Plugin and Fundraising Platform (plugin)
- Affected versions: All versions up to and including 4.14.4
- Published: August 28, 2026 at 12:16:30 PM (UTC)
- Last modified: August 28, 2026 at 4:18:19 PM (UTC)
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS v3.1 vector string:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Authenticated attacker required; privileges required: Low (Contributor-level access or higher); user interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting (XSS) issue triggered via the give_form shortcode. The plugin passes the continue_button_title and display_style shortcode attributes through sanitize_text_field() but does not properly escape them when output into HTML data attributes. Because these values are written into data attributes without required escaping, an authenticated user with Contributor-level access or higher can include payloads that persist in stored content and execute in the browser of any user who views the injected page.
The root cause is insufficient output escaping for data attribute contexts; input was filtered with sanitize_text_field() but the filtered values were later emitted into HTML without escaping appropriate for data attributes. The issue is associated with the give_form shortcode processing of the listed attributes.
Impact is limited to script execution in the context of pages that include the vulnerable shortcode. The vulnerability does not inherently describe remote code execution on the server or availability impacts, but can be used to affect confidentiality and integrity in the browser context of site visitors and logged-in users.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who publish pages, and external contributors who submit content. If a contributor uses the give_form shortcode with a crafted continue_button_title or display_style value, that script can be stored and later executed when an editor, administrator, or visitor views the page.
- Stored scripts could read or exfiltrate data visible in the affected user’s browser, such as session-visible profile information or email addresses shown on the page.
- Visible or harvested email addresses increase the risk of targeted phishing or social engineering against staff or donors.
- A malicious script running in an authenticated user session could attempt actions in the context of that user, depending on what the site exposes in the browser.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level accounts. Limit who can publish or insert shortcodes.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected changes to content that includes shortcodes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/give/tags/4.14.2/includes/shortcodes.php#L149
- https://plugins.trac.wordpress.org/browser/give/tags/4.14.2/src/DonationForms/Blocks/DonationFormBlock/Controllers/BlockRenderController.php#L57
- https://plugins.trac.wordpress.org/browser/give/tags/4.14.2/src/DonationForms/Shortcodes/GiveFormShortcode.php#L32
- https://plugins.trac.wordpress.org/browser/give/trunk/includes/shortcodes.php#L149
- https://plugins.trac.wordpress.org/browser/give/trunk/src/DonationForms/Blocks/DonationFormBlock/Controllers/BlockRenderController.php#L57
- https://plugins.trac.wordpress.org/browser/give/trunk/src/DonationForms/Shortcodes/GiveFormShortcode.php#L32
- https://plugins.trac.wordpress.org/changeset/3501918/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/dd26a390-0de5-4699-a790-cac86bf4a057?source=cve
