CVE-2026-97643: GiveWP WordPress Plugin XSS Vulnerability

CVE-2026-97643 Overview

CVE-2026-97643 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.17.0. It resides in the givewp_campaign_grid shortcode handler, which fails to sanitize user-supplied attributes before rendering them into HTML. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor views the affected page. The issue is tracked under CWE-79.

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, admin account takeover, and arbitrary actions in authenticated sessions.

Affected Products

GiveWP – Donation Plugin and Fundraising Platform for WordPress
All versions up to and including 4.17.0
Fixed in version 4.18.0

Discovery Timeline

2026-10-10 - CVE-2026-97643 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97643

Vulnerability Analysis

The vulnerability exists in GiveWP's campaign grid shortcode processing pipeline. The CampaignGridShortcode::parseAttributes() function accepts user-controlled shortcode attributes including filter_by, layout, sort_by, and order_by without adequate input sanitization. The parsed attributes are then passed to the render template at src/Campaigns/Blocks/CampaignGrid/render.php, which emits json_encode($attributes) directly inside a single-quoted HTML attribute. Critically, the template does not wrap the output in esc_attr() before placement. Because json_encode() does not escape single quotes by default, an attacker-supplied ' character breaks out of the enclosing attribute context. Once outside the attribute, an attacker can introduce additional HTML attributes or inline event handlers that execute arbitrary JavaScript in the context of the victim's browser session.

Root Cause

The root cause is twofold: insufficient input validation inside parseAttributes() and missing output escaping in the shortcode render template. The combination of json_encode() output placed inside single-quoted HTML attributes without esc_attr() wrapping violates WordPress output-escaping conventions. Any shortcode attribute value containing a single quote escapes its intended attribute boundary.

Attack Vector

An authenticated user with Contributor-level privileges or higher inserts a [givewp_campaign_grid] shortcode into post or page content. The attacker supplies a crafted value for filter_by, layout, sort_by, or order_by that contains a single quote followed by additional HTML attributes or event handlers. When any user, including administrators, renders the page, the injected JavaScript executes in their browser. The scope-changed CVSS vector indicates the exploit can affect resources beyond the vulnerable component.

No verified public exploit code is available. See the Wordfence vulnerability analysis and the vulnerable source at CampaignGridShortcode.php line 91 for technical details.

Detection Methods for CVE-2026-97643

Indicators of Compromise

Post or page content containing [givewp_campaign_grid] shortcodes with single-quote characters or encoded quote sequences in the filter_by, layout, sort_by, or order_by attributes.
Rendered pages whose source contains attribute data-blobs where json_encode output has escaped the enclosing single-quoted HTML attribute.
Unexpected <script> tags, on* event handlers, or external script references appearing adjacent to GiveWP campaign grid markup.

Detection Strategies

Scan the WordPress wp_posts table for post_content entries containing givewp_campaign_grid combined with suspicious characters such as ', onerror=, onload=, or <script.
Monitor web server access logs for Contributor or Author account activity that creates or edits posts shortly before anomalous script execution reports from visitors.
Deploy a web application firewall rule that inspects outbound HTML responses for malformed GiveWP shortcode attribute payloads.

Monitoring Recommendations

Alert on new or modified posts authored by low-privilege roles (Contributor, Author) that embed GiveWP shortcodes.
Track Content Security Policy (CSP) violation reports to identify inline script execution originating from pages that render GiveWP campaign grids.
Review WordPress audit logs for shortcode insertions and attribute modifications across all published and draft content.

How to Mitigate CVE-2026-97643

Immediate Actions Required

Update the GiveWP plugin to version 4.18.0 or later immediately via the WordPress plugin dashboard.
Audit all existing posts and pages for the [givewp_campaign_grid] shortcode and inspect attribute values for injection payloads.
Review the user base and revoke Contributor-level or higher access from accounts that do not require content authoring privileges.

Patch Information

The vendor released GiveWP version 4.18.0 to address this vulnerability. The fix is published at the GitHub Release 4.18.0. The patched code introduces proper sanitization in CampaignGridShortcode::parseAttributes() and applies output escaping to the attribute block emitted by the render template.

Workarounds

Temporarily disable the GiveWP plugin if an immediate update is not feasible on production systems.
Restrict post editing capabilities so that only trusted Editor and Administrator roles can author content containing shortcodes.
Deploy a web application firewall rule that blocks requests containing givewp_campaign_grid shortcode attributes with single-quote characters or HTML event handlers.

bash

# Update GiveWP via WP-CLI to the patched release
wp plugin update give --version=4.18.0

# Verify installed version
wp plugin get give --field=version

# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%givewp_campaign_grid%' AND post_status IN ('publish','draft','pending');"