CVE-2026-97643

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.17.1

Description Stored Cross-Site Scripting (XSS) occurs via the givewp campaign grid shortcode. The issue stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes filter by, layout, sort by, and order by within the CampaignGridShortcode::parseAttributes() function. Because the render template uses json encode($attributes) inside a single-quoted HTML attribute without applying esc attr(), and since json encode() does not escape single quotes by default, an attacker can break out of the attribute. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version newer than 4.17.0.