Medium severity6.5NVD Advisory· Published Sep 21, 2026

CVE-2026-85113

Description

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/b092c718-9a29-4153-894f-47892e7ba423/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000