CVE-2026-5510: 
WordPress vulnerability analysis and mitigation

CVE-2026-5510 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. It affects all versions up to and including 4.14.4, and is caused by insufficient input sanitization and output escaping on the continue_button_title and display_style attributes of the give_form shortcode. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The vulnerable shortcode attributes continue_button_title and display_style are passed through WordPress's sanitize_text_field() function, which strips HTML tags but does not perform HTML attribute encoding. When these values are subsequently rendered into HTML data attributes without proper escaping, an attacker can break out of the attribute context and inject executable JavaScript. Exploitation requires only Contributor-level WordPress authentication and no user interaction beyond a victim visiting the injected page (GitHub Advisory, Wordfence). The vulnerable code paths are located in includes/shortcodes.php and src/DonationForms/Shortcodes/GiveFormShortcode.php (WordPress Trac).

Successful exploitation allows an authenticated contributor to persistently inject malicious scripts into WordPress pages served to all site visitors. Consequences include session cookie theft, credential harvesting, unauthorized page content modification, and redirection of users to malicious external sites. While availability is not directly impacted, the confidentiality and integrity risks extend to any user who visits an injected page, including administrators whose elevated session tokens could be stolen to enable full site takeover (GitHub Advisory, Wordfence).

As of the disclosure date (August 28, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level WordPress authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running GiveWP plugin version 4.14.4 or earlier using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Create or edit a page/post: As a Contributor, create a new post or edit an existing one that includes the give_form shortcode.
4. Inject malicious payload: Insert a crafted shortcode with an XSS payload in the continue_button_title or display_style attribute, e.g., [give_form id="1" continue_button_title='x" onmouseover="alert(document.cookie)' display_style='modal']. Because sanitize_text_field() does not encode HTML attribute metacharacters, the payload survives sanitization.
5. Publish the content: Submit the post for review or publish it directly (depending on role capabilities).
6. Trigger execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the malicious script executes in their browser, enabling session token theft or further malicious actions (GitHub Advisory, Wordfence).

• Logs: WordPress post/page content containing give_form shortcodes with unusual attribute values including JavaScript event handlers (e.g., onmouseover, onerror, onfocus) or <script> fragments; audit log entries showing Contributor-level users creating or editing pages with give_form shortcodes.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing encoded or obfuscated JavaScript within give_form shortcode attributes.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits; unusual POST requests to external endpoints originating from site visitor sessions.
• Process/Application: Browser console errors or unexpected redirects reported by users visiting pages containing give_form shortcodes.

Update the GiveWP plugin to a version newer than 4.14.4, which includes the fix applied in changeset 3501918 (WordPress Trac). As interim mitigations: restrict Contributor-level role assignment to only trusted users; consider disabling the give_form shortcode if it is not actively required; and deploy Web Application Firewall (WAF) rules to detect and block common XSS payloads in shortcode attributes. Regularly audit WordPress user roles and permissions to minimize the attack surface (Wordfence).