{"cvss":6.5,"datePublished":"2026-10-22T00:00:00Z","dateUpdated":"2026-10-22T00:00:00Z","description":"The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.","dueDate":"","id":"CVE-2026-85113","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"GiveWP","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"MEDIUM","source":"vulncheck_kev","title":"GiveWP GiveWP Improper Neutralization of Special Elements in Output Used by a Downstream Component","vendor":"GiveWP"}