CVE-2026-85113 — GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

CVE-2026-85113

GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name PUBLISHED

Description (CNA)

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Affected (CNA)

Vendor / product	Versions
Unknown / GiveWP	affected 4.13.2 before 4.16.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b092c718-9a29-4153-894f-47892e7ba423/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.