CVE-2026-85113 GiveWP CVE debrief

Who should care

Defenders responsible for WordPress sites using the GiveWP plugin should assess their exposure to this vulnerability and prioritize verification and remediation efforts. This includes reviewing public pages for potential shortcode injection vulnerabilities, verifying the plugin version, and monitoring for suspicious shortcode activity. Security teams and operators managing WordPress environments with the GiveWP plugin should take immediate action to ensure

Why it matters

The GiveWP WordPress plugin vulnerability allows unauthenticated users to execute arbitrary shortcodes, posing a risk to WordPress sites using the plugin. Defenders should prioritize verification and remediation.

• Unauthenticated users can execute arbitrary shortcodes registered on the site
• Potential for shortcode injection vulnerabilities on public pages
• Need for verification and remediation of the GiveWP plugin

Technical summary

The GiveWP WordPress plugin before 4.16.9 is vulnerable to shortcode injection attacks. The plugin fails to remove shortcode delimiters from donor-supplied values before rendering them on public pages. This flaw can be exploited by unauthenticated users through nested shortcode structures, allowing them to execute arbitrary shortcodes registered on the site. The vulnerability poses a significant risk to WordPress sites using the GiveWP plugin, as attackers could leverage this issue to perform unauthorized actions. Defenders should prioritize verifying and updating the plugin to version 4.16.9 or later.

Defensive priority

Defenders should prioritize verifying and updating the GiveWP plugin to version 4.16.9 or later, and review public pages for potential shortcode injection vulnerabilities.

Recommended defensive actions

• Verify and update the GiveWP plugin to version 4.16.9 or later
• Review public pages for potential shortcode injection vulnerabilities
• Monitor for suspicious shortcode activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability but confirm that the GiveWP plugin is affected. The CVE Program record (CVE-2026-85113) and the NVD detail page offer source-provided metadata and vulnerability assessments. However, further verification is needed to understand the full scope of affected deployments and potential impacts. Defenders should verify the plugin version and review public pages for potential shortcode injection vulnerabilities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.