Stored cross-site scripting in GiveWP givewp_campaign_grid shortcode
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
GiveWP Donation Plugin and Fundraising Platform for WordPress through 4.17.0 has a stored cross-site scripting flaw in its givewp_campaign_grid shortcode. Shortcode attributes are not sanitized or escaped, so a single quote breaks out of an HTML attribute (CWE-79). An attacker with Contributor access or higher can inject scripts into pages that run when a user opens them.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GiveWP Donation Plugin and Fundraising Platform.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-10 Threatist record created from CVE-2026-97643
- 2026-10-10 Alias added: GHSA-rx8r-4hqr-25gw
- 2026-10-11 CISA SSVC decision points changed
- 2026-10-11 Priority changed: MEDIUM → LOW
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=cve
- https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Blocks/CampaignGrid/render.php#L6
- https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L91
- https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L22
- https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/ShortcodeRenderController.php#L65
- https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L28
- https://github.com/impress-org/givewp/releases/tag/4.18.0
More stellarwp vulnerabilities
- TI-2024-05498 Deserialization of untrusted data in stellarwp GiveWP – Donation Plugin and Fundraising… CVSS 3.1CRITICAL 10.0
- TI-2023-02655 BookIt <= 2.3.7 - Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2024-07671 The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-03888 The Events Calendar < 6.4.0.1 - Reflected XSS CVSS 3.1CRITICAL 9.1
- TI-2024-07745 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2024-04952 The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-97643 · CVE Program
- CVE-2026-97643 · NVD
- FIRST EPSS
- GHSA-rx8r-4hqr-25gw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences