CVE-2026-13246 Overview
CVE-2026-13246 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.16.0. The vulnerability exists in the givewp_campaign_comments shortcode, where the block_id and related attributes are not properly sanitized or escaped. Authenticated attackers with author-level access or above can inject arbitrary JavaScript that executes when users view an affected page.
Critical Impact
Authenticated attackers with author permissions can persist malicious scripts in donation campaign pages, enabling session theft, credential harvesting, and administrative account takeover through cross-site scripting payloads.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All versions up to and including 4.16.0
- Sites using the givewp_campaign_comments shortcode or the corresponding block
Discovery Timeline
- 2026-07-01 - CVE-2026-13246 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13246
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in GiveWP's campaign comments feature. The plugin registers the givewp_campaign_comments shortcode through RegisterCampaignShortcodes.php. When the shortcode is processed, CampaignCommentsShortcode::parseAttributes() collects user-supplied attributes including block_id. The BlockRenderController::render() method then passes the value to the render template. The blockId value is interpolated directly into a single-quoted HTML attribute without passing through WordPress's esc_attr() escaping function.
An author-level user can craft a post containing the shortcode with a block_id attribute that breaks out of the single-quoted attribute context. The injected payload executes in the browser of any user who views the page, including administrators. This enables session hijacking, privilege escalation through administrative actions, and arbitrary content modification.
Root Cause
The root cause is missing output escaping on user-controlled input. WordPress provides esc_attr() specifically to neutralize characters that terminate HTML attribute contexts. Neither CampaignCommentsShortcode.php (lines 17 and 78) nor render.php (line 20) applies this function to the blockId value before HTML interpolation. Insufficient input sanitization at the parse stage compounds the issue.
Attack Vector
An attacker authenticated as an author or higher creates or edits a post that embeds the givewp_campaign_comments shortcode. The attacker supplies a block_id value containing an attribute-breaking sequence followed by an event handler such as onmouseover or an inline script. When the post renders, the payload executes in the victim's browser under the site's origin. Because the impact scope changes, an author can achieve script execution against higher-privileged users. Refer to the Wordfence advisory for additional exploitation context.
Detection Methods for CVE-2026-13246
Indicators of Compromise
- Posts or pages containing givewp_campaign_comments shortcode with unusual characters such as single quotes, angle brackets, or on* event handler names in the block_id attribute.
- Rendered HTML output containing script tags or event handlers originating from GiveWP campaign comment blocks.
- Author-level accounts creating or editing posts that embed GiveWP shortcodes outside their normal workflow.
Detection Strategies
- Audit the WordPress wp_posts table for shortcode occurrences of givewp_campaign_comments and inspect attribute values for injection patterns.
- Review web server access logs for POST requests to /wp-admin/post.php from author-level accounts that submit GiveWP shortcode content.
- Deploy a web application firewall rule to flag responses containing block_id=' followed by quote-breaking payloads.
Monitoring Recommendations
- Enable WordPress activity logging to track post edits and content changes by author-tier users.
- Monitor Content Security Policy (CSP) violation reports for inline script execution on donation and campaign pages.
- Alert on new or modified posts containing GiveWP shortcodes pending administrator review.
How to Mitigate CVE-2026-13246
Immediate Actions Required
- Update the GiveWP plugin to a version later than 4.16.0 that includes the fix from changeset 3590193.
- Review all posts and pages containing the givewp_campaign_comments shortcode for malicious attribute values.
- Audit author-level and higher user accounts for signs of compromise or unauthorized activity.
Patch Information
The vendor addressed the vulnerability in the GiveWP plugin release following version 4.16.0. The fix applies proper esc_attr() escaping to the blockId value before HTML attribute interpolation. See the WordPress plugin changeset 3590193 for the code-level fix and the Wordfence vulnerability record for tracking details.
Workarounds
- Restrict author and higher role assignments to trusted users until the plugin is updated.
- Temporarily disable the GiveWP campaign comments block and shortcode if patching is delayed.
- Enforce a Content Security Policy that blocks inline script execution on pages rendering GiveWP shortcodes.
# Verify installed GiveWP version via WP-CLI and update to the patched release
wp plugin get give --field=version
wp plugin update give
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
