CVE-2026-13246 is a stored Cross-Site Scripting vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The issue exists in versions up to and including 4.16.0 due to improper neutralization of input in the CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() functions. Specifically, the 'block_id' shortcode attribute is interpolated directly into a single-quoted HTML attribute without proper escaping (esc_attr()), enabling authenticated attackers with author-level privileges or higher to inject arbitrary JavaScript. This script executes in the context of users who visit the injected pages, potentially leading to session hijacking or other client-side impacts.

An attacker with author-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages rendered by the GiveWP plugin. This can lead to client-side code execution in the browsers of users who view the affected pages, potentially compromising user sessions or performing unauthorized actions on behalf of users. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only. Monitor for updates from the vendor (stellarwp) regarding patches or official mitigations. Avoid using the vulnerable shortcode attributes with untrusted input.