Security Alert Summary
The GiveWP WordPress plugin before 4.16.9 fails to remove shortcode delimiters from donor-supplied values before rendering them on public pages. The plugin’s shortcode stripping can be bypassed by nesting, which allows unauthenticated users to execute arbitrary shortcodes that are registered on the site.
CVE Details
- CVE ID: CVE-2026-85113
- Affected component: GiveWP WordPress plugin
- Affected versions: Versions before 4.16.9 (example affected version listed: 4.13.2)
- Published: September 21, 2026 at 9:17:06 AM UTC
- Last modified: September 21, 2026 at 3:17:32 PM UTC
- CVSS v3.1: Base score 6.5 (MEDIUM) — Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction:
- Privileges required: NONE
- User interaction: NONE
- Attack vector: NETWORK
- Attack complexity: LOW
- Scope: UNCHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-74
Technical Details
According to the advisory, GiveWP did not remove shortcode delimiters from values supplied by donors before rendering those values on public pages. The plugin applied a shortcode-stripping routine, but that routine can be bypassed by nesting shortcodes. As a result, an unauthenticated user can cause the site to parse and execute arbitrary shortcodes that are registered on the site.
The vulnerability is rooted in insufficient sanitization of user-supplied content prior to output. The advisory does not name specific functions or REST endpoints. The direct technical consequence is execution of shortcodes provided via donor fields or similar public-facing text inputs when nesting defeats the stripping logic.
Impact is limited to what registered shortcodes are capable of doing on the affected site. Where shortcodes expose or render internal data, or perform actions, those behaviors could be triggered by an unauthenticated actor; the advisory reports confidentiality and integrity impacts as low and availability impact as none.
How This Could Impact Your Website
Consider a small charity using GiveWP to accept donations. A site owner manages plugins and settings, an internal staff member reviews donor entries, and an external contractor occasionally updates the theme or shortcodes. If an unauthenticated donor field can contain nested shortcode constructs, an attacker could cause shortcodes registered on the site to run in the context of public pages.
Practical consequences may include limited exposure of information rendered by those shortcodes (for example, email addresses or other donor metadata shown by a shortcode) and the ability to modify rendered content where shortcodes perform transformations. This can increase the risk of targeted phishing or social engineering if attacker-controlled content reveals contact details or produces misleading public content. The advisory indicates a low confidentiality and integrity impact rather than full site compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any roles that can submit public content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and audit any custom shortcodes for unsafe output handling.
- Monitor site activity and public content for unusual behavior or unexpected shortcode output.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
