Stored Cross-Site Scripting Vulnerability in GiveWP Donation Plugin

CVE-2026-5510

What is CVE-2026-5510?

The GiveWP Donation Plugin is susceptible to a Stored Cross-Site Scripting vulnerability via the 'give_form' shortcode, affecting all versions up to and including 4.14.4. This vulnerability arises from inadequate input sanitization and output escaping of the continue_button_title and display_style attributes within the shortcode. Although these attributes are processed with sanitize_text_field(), they are not properly escaped when rendered in HTML data attributes. As a result, authenticated attackers with Contributor-level access and above can exploit this flaw to inject malicious scripts into web pages, which will execute when users visit the affected pages.

References