CVE-2026-5510 Overview
CVE-2026-5510 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.14.4. It exists in the give_form shortcode handler, where the continue_button_title and display_style attributes pass through sanitize_text_field() but are not properly escaped when rendered inside HTML data attributes. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view an affected page. The issue is categorized under CWE-79.
Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress
- All versions up to and including 4.14.4
- Deployments exposing the give_form shortcode to Contributor-level or higher authors
Discovery Timeline
- 2026-08-28 - CVE-2026-5510 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-5510
Vulnerability Analysis
The vulnerability resides in GiveWP's shortcode processing pipeline. When a page or post contains a [give_form] shortcode, the plugin reads user-supplied attributes and renders them into HTML output. Two attributes, continue_button_title and display_style, are sanitized with WordPress's sanitize_text_field() function. That function strips tags and normalizes whitespace, but it does not encode characters such as double quotes, single quotes, or angle brackets that are dangerous inside HTML attribute contexts.
Because the sanitized values are then interpolated into data-* attributes without a call to esc_attr(), an attacker can break out of the attribute context and inject event handlers or additional markup. The payload persists in post content, so every visitor rendering that post triggers script execution in their browser session.
Root Cause
The root cause is missing context-appropriate output escaping. sanitize_text_field() is an input filter, not an output encoder, and it is not a substitute for esc_attr() when values are placed inside HTML attributes. Relevant source is visible in the plugin's shortcode handler, the GiveFormShortcode class, and the BlockRenderController.
Attack Vector
An authenticated attacker with Contributor privileges creates or edits a post containing a [give_form] shortcode. They supply a crafted continue_button_title or display_style value that breaks out of the surrounding attribute quotes and adds an event handler payload. When an administrator previews the post or a visitor loads the published page, the browser executes the injected script under the site's origin. See the Wordfence vulnerability analysis for additional technical detail.
No verified proof-of-concept code is available. The vulnerability mechanism is described in prose above and in the linked plugin source references.
Detection Methods for CVE-2026-5510
Indicators of Compromise
- Post or page content containing [give_form] shortcodes with unusual characters such as ", <, >, on event handlers, or javascript: sequences inside continue_button_title or display_style
- New or modified posts authored by Contributor-level accounts that unexpectedly reference GiveWP shortcodes
- Outbound requests from visitor browsers to unfamiliar domains after loading donation pages
Detection Strategies
- Query the WordPress wp_posts table for post content matching give_form combined with suspicious attribute values, including quote characters or on\w+= patterns
- Review web server access logs for anomalous responses on pages that render GiveWP shortcodes, particularly requests carrying reflected script fragments
- Correlate WordPress audit logs of post creation and update events with the roles of the authoring users, focusing on Contributor-tier accounts
Monitoring Recommendations
- Enable content-integrity monitoring on published posts and pages that embed donation forms
- Alert on Contributor accounts editing content that renders on public pages viewed by administrators
- Monitor for administrator session anomalies such as unexpected privilege changes, new admin users, or plugin installations following visits to donation pages
How to Mitigate CVE-2026-5510
Immediate Actions Required
- Update the GiveWP plugin to a version later than 4.14.4 that includes the fix from WordPress changeset #3501918
- Audit all posts and pages using the [give_form] shortcode and remove any suspicious attribute content
- Review Contributor and Author accounts, rotate credentials, and remove accounts that are no longer needed
Patch Information
The GiveWP maintainers addressed the flaw in the commit tracked as changeset #3501918. The fix adds proper output escaping to the affected shortcode attributes so that user-supplied values cannot break out of HTML attribute context. Site owners should upgrade to the first released version that includes this changeset.
Workarounds
- Restrict shortcode usage by removing the [give_form] shortcode from posts editable by low-privilege roles until the plugin is patched
- Revoke the edit_posts capability from Contributor-level users temporarily, or downgrade untrusted accounts to Subscriber
- Deploy a web application firewall rule that blocks POST requests containing give_form shortcodes with attribute values holding quote characters or event handler patterns
# Example WP-CLI commands to locate posts containing the vulnerable shortcode
wp post list --post_type=any --s='[give_form' --fields=ID,post_author,post_status,post_title
# Update the GiveWP plugin to the latest patched release
wp plugin update give
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
