Vulnerability · Published Sep 21, 2026 · Assigned by WPScan

CVE-2026-85113GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

Medium 6.5

In plain English

A medium-severity injection in GiveWP from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Affected products (as reported)

Vendor	Product	Versions
Unknown	GiveWP	4.13.2 – before 4.16.9

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/b092c718-9a29-4153-894f-47892e7ba423/ exploit, vdb-entry, technical-description