CVE detail
CVE-2026-13246
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 26.4 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 13
- within the 30d window
- Peak daily
- 12
- highest bucket
Evidence
Source links by recency
13 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 29, 2026 to July 5, 2026)Wordfence
tory Pro Slider Revolution 7.0.0-7.0.16 - Unauthenticated Stored Cross-Site Scripting 7.2 CVSS Rating 7.2 (High) CVE-ID CVE-2026-57678 Patch Status Patched Published Jun 30, 2026 Affected Software Slider Revolution [revslider] Researcher daroo More Details > SpaLab | Beauty Salon WordPress Survey Maker by AYS Timetics – Appointment Booking Calendar & S
vendorwww.wordfence.comJul 9, 2026, 3:39 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8f489-6b31-45d8-a122-bbaa283a2b10?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590193%40give&new=3590193%40give&sfp_email=&sfph_mail=plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/render.php#L20plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/trunk/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L78plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Shortcodes/CampaignCommentsShortcode.php#L17plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/render.php#L20plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Blocks/CampaignComments/Controller/BlockRenderController.php#L23plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM - https://plugins.trac.wordpress.org/browser/give/tags/4.16.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L30plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJul 1, 2026, 5:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66390CVSS 6.1 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0,…
- CVE-2026-66396CVSS 9.3 · Critical
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescap…
- CVE-2026-66395CVSS 9.4 · Critical
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by craftin…
- CVE-2026-66394CVSS 9.3 · Critical
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the…
- CVE-2026-66475CVSS 5.9 · Medium
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
- CVE-2026-66448CVSS 6.5 · Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.