CVE-2026-13246: GiveWP Stored XSS in Campaign Comments Shortcode

Technical summary

The vulnerability exists in the 'givewp_campaign_comments' shortcode handler, specifically within CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() methods. The plugin fails to properly sanitize the 'block_id' and related shortcode attributes before processing them. When the blockId value is interpolated into a single-quoted HTML attribute without using WordPress's esc_attr() escaping function, it allows injection of arbitrary HTML and JavaScript. An attacker with author-level access or above can craft a malicious shortcode containing JavaScript payloads that persist in the page content and execute whenever any user views the affected page. The attack requires authentication but bypasses client-side protections and stored content validation.

Business impact

Organizations using GiveWP to manage donations face several operational risks. Compromised donation pages could be used to harvest sensitive donor information, manipulate donation amounts, or redirect users to attacker-controlled sites. The persistent nature of stored XSS means the malicious code remains in pages until manually removed, potentially affecting hundreds or thousands of site visitors. Organizations running multi-author WordPress installations—common for nonprofits and fundraising platforms—are particularly vulnerable since author-level access is more widely distributed. Reputation damage is significant: donors discovering their data was exposed through a compromised donation form will lose trust. Additionally, website defacement and SEO poisoning could occur if malicious content alters visible page content or injects hidden links.

Affected systems

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress in versions 4.16.0 and earlier is affected. The vulnerability requires an authenticated WordPress user with author-level access or higher permissions. Any WordPress site running GiveWP with this version range and multiple authors or contributors is at risk. The vulnerability does not affect unauthenticated users; however, any authenticated user meeting the permission threshold can exploit it, potentially affecting sites with loose user management practices.

Exploitability

Exploitation is relatively straightforward for an authenticated attacker with author-level permissions. The attacker creates or edits a page containing the 'givewp_campaign_comments' shortcode and injects a malicious payload into the 'block_id' attribute. No special tools or advanced technical knowledge is required—a simple text editor suffices. The payload executes immediately when the page is visited by any user, regardless of their permissions. This attack does not require user interaction beyond visiting an affected page, making it effective at scale. However, the requirement for authentication and author-level access limits the threat surface compared to unauthenticated XSS vulnerabilities.

Remediation

Organizations using GiveWP should update immediately to a patched version released after version 4.16.0. Verify the latest available version through the official GiveWP website or WordPress plugin repository. Until patching is possible, restrict author-level WordPress access to trusted users only, conduct a content audit to identify any existing malicious shortcodes, and consider disabling the 'givewp_campaign_comments' shortcode if it is not actively used. Web application firewalls (WAF) may help detect and block injection attempts, though they are not a substitute for patching.

Patch guidance

Upgrade the GiveWP plugin to a version released after July 1, 2026 that addresses this vulnerability. Access the WordPress admin dashboard, navigate to Plugins, and check for available updates. Most WordPress installations can be set to auto-update plugins; if enabled, this should deploy the patch automatically. After patching, verify in the plugin settings that the shortcode attributes are correctly sanitized by inspecting a test page with the shortcode. For organizations with custom GiveWP implementations, review any custom code that may interact with the 'givewp_campaign_comments' shortcode to ensure it does not replicate the same sanitization bypass.

Detection guidance

Search existing page and post content for the 'givewp_campaign_comments' shortcode using WordPress database queries or search functionality. Inspect the 'block_id' attribute value for any unusual content, script tags, or encoded payloads. Log analysis should focus on WordPress user accounts with author-level access performing content creation or editing activities, particularly any accounts that are infrequently used or belong to inactive users. Network IDS/IPS tools monitoring outbound requests from the web server may detect exfiltration attempts triggered by injected scripts. Consider enabling WordPress audit logging plugins to track shortcode modifications.

Why prioritize this

This vulnerability warrants medium-to-high priority remediation despite the medium CVSS score. While authentication is required, the prevalence of GiveWP across nonprofit and fundraising sectors, combined with the persistent nature of stored XSS and the potential for data theft or website defacement, creates meaningful business risk. The attack bypasses user expectations of content safety and can affect users who have no role in website administration. Organizations with multiple authors or weaker access controls should prioritize this over lower-impact vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a network-accessible, low-complexity vulnerability requiring low privileges (author-level access) to exploit, with no user interaction required for the injected code to execute. Integrity and confidentiality impact is limited to the context of affected pages, and there is no availability impact. However, the score does not fully capture the reputational and data exfiltration risks specific to donation platforms, where user trust and data confidentiality are paramount. Organizations handling sensitive donor information should treat this as higher priority than the numeric score alone suggests.

Frequently asked questions