CVE-2026-13246

Name of the Vulnerable Software and Affected Versions GiveWP – Donation Plugin and Fundraising Platform versions prior to 4.16.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of user-supplied attributes within the givewp campaign comments shortcode. Specifically, the block id and other attributes are processed in the CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() functions, where the blockId value is interpolated directly into a single-quoted HTML attribute without using esc attr(). This allows authenticated attackers with author-level access or higher to inject arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update GiveWP – Donation Plugin and Fundraising Platform to version 4.16.1 or later.