CVE-2026-85113

MediumCVSS 6.5/10Last modified Sep 21, 2026

Description

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-851147.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do n CVE-2026-851155.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do n CVE-2026-851166.5The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Con CVE-2026-851176.5The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including th CVE-2026-851189.8The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, CVE-2026-85128.3Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific U CVE-2026-851219.1The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated CVE-2026-851228.8The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for CVE-2026-851235.3The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for CVE-2026-851247.5@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding the CVE-2026-851255.1The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. Th CVE-2026-851267.2The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of it