{"id":"CVE-2026-97643","summary":"GiveWP \u003c= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes","details":"The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","modified":"2026-10-11T02:46:59.090182276Z","published":"2026-10-10T05:31:04.713Z","database_specific":{"cna_assigner":"Wordfence","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97643.json"},"references":[{"type":"WEB","url":"https://github.com/impress-org/givewp/releases/tag/4.18.0"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L28"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Blocks/CampaignGrid/render.php#L6"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L22"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L91"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/ShortcodeRenderController.php#L65"},{"type":"WEB","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=cve"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97643.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97643"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/impress-org/givewp","events":[{"introduced":"0"},{"fixed":"cd3271d64fe32fcc4a9673949a990a73a5738e3a"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"last_affected":"4.17.0"}]}}],"versions":["4.17.0","4.16.9","4.16.8.1","4.16.8","4.16.7","4.16.7.2","4.16.7.1","4.16.6.1","4.16.6","4.16.5.1","4.16.5","4.16.4","4.16.3","4.16.2","4.16.1","4.16.0","4.15.5","4.15.4","4.15.3","4.15.1","4.14.1","4.14.0","4.13.1","4.13.0","4.9.0","4.8.0","4.7.0","4.6.1","4.6.0","4.5.0","4.4.0","4.3.2","4.3.0","4.2.0","4.0.0","3.15.0","3.14.1","3.14.0","3.13.0","3.12.0","3.11.0","3.10.0","3.9.0","3.8.0","3.7.0","3.6.0","3.5.0","3.4.1","3.4.0","3.2.1","3.2.0","3.0.3","3.0.2","3.0.1","3.0.0","2.33.5","2.33.4","2.33.3","2.33.2","2.33.1","2.33.0","2.32.0","2.31.1","2.31.0","2.30.0","2.29.2","2.25.0","2.24.2","2.24.1","2.24.0","2.23.2","2.23.1","2.23.0","2.22.3","2.22.2","2.22.1","2.22.0","2.21.4","2.21.2","2.21.1","2.21.0","2.20.2","2.20.1","2.20.0","2.19.8","2.19.7","2.19.6","2.19.6-alpha","2.19.5","2.19.4","2.19.3","2.19.2","2.19.1","2.19.0","2.18.1","2.17.3","2.17.2","2.17.1","2.17.0","2.16.2","2.16.1","2.16.0","2.15.0","2.14.0","2.13.4","2.13.3","2.13.2","2.13.1","2.13.0","2.12.3","2.12.2","2.12.1","2.12.0","2.11.3","2.11.2","2.11.1","2.11.0","2.10.4","2.10.3","2.10.2","2.10.1","2.10.0","2.9.7","2.9.6","2.9.5","2.9.4","2.9.3","2.9.2","2.9.1","2.9.0","2.8.1","2.8.0","2.8.0-rc.1","2.8.0-beta.3","2.8.0-beta.2","2.8.0-beta.1","2.8.0-alpha.1","2.8.0-alpha.2","2.7.5","2.7.4","2.7.3","2.7.2","2.7.1","2.7.0","2.6.3","2.6.2","2.6.1","2.6.0","2.5.13","2.5.12","2.5.10","2.5.9","2.5.8","2.5.7","2.5.5","2.5.4","2.5.3","2.5.2","2.0.5","2.0.4","2.0.3","2.0.2","2.0.1","2.0.0","1.8.19","1.18.18","1.8.17","1.8.16","1.8.15","1.8.14","1.8.13","1.8.12","1.8.11","1.8.10","1.8.9","1.8.8","1.8.7.1","1.8.7","1.8.6","1.8.5","1.8.4","1.8.3","1.8.2","1.8.1","1.8","1.7.2","1.7.1","1.7","1.6.4","1.6.3","1.6.2","1.6.1","1.6","1.5.1","1.5.2","1.5","1.4.5","1.4.4","1.4.3","1.4.2","1.4.1","1.4","1.3.6","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1.1","1.3.1","1.3.0.4","1.3","1.2.1","1.2","1.1","1.0.1","1.0.0","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97643.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}]}