CVE-2026-85113

GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Affected

GiveWP

CVSS v3.1 WPSCAN

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.31% chance of exploitation in the next 30 days, 22nd percentile

Published

2026-09-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/b092c718-9a29-4153-894f-47892e7ba423/

References

• CVE Record
• NVD entry