CVE detail
CVE-2026-13246
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 26.4 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
13 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 29, 2026 to July 5, 2026)Wordfence
tory Pro Slider Revolution 7.0.0-7.0.16 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-57678 Patch Status Patched Published Jun 30, 2026 Affected Software Slider Revolution [revslider] Researcher daroo More Details > SlimStat Analytics SpaLab | Beauty Salon WordPress Survey Maker by AYS Timetics – Appointment B
vendorwww.wordfence.comJul 9, 2026, 3:39 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8f489-6b31-45d8-a122-bbaa283a2b10?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590193%40give&new=3590193%40give&sfp_email=&sfph_mail=plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/render.php#L20plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/render.php#L20plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66358CVSS 5.1 · Medium
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
- CVE-2026-15421CVSS 6.4 · Medium
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to,…
- CVE-2026-66591CVSS 6.5 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects…
- CVE-2026-27365CVSS 5.9 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects Publi…
- CVE-2026-66603CVSS 6.5 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affe…
- CVE-2026-52873CVSS 6.9 · Medium
Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js cre…