CVE-2026-13246 is a stored Cross-Site Scripting vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The issue exists in versions up to and including 4.16.0 due to improper neutralization of input in the 'block_id' and other shortcode attributes of the 'givewp_campaign_comments' shortcode. Specifically, the CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() functions fail to properly sanitize and escape user-supplied attributes, interpolating the blockId value directly into a single-quoted HTML attribute without using esc_attr(). This allows authenticated attackers with author-level permissions or higher to inject arbitrary JavaScript that executes in the context of users visiting the injected pages.

An attacker with author-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the vulnerable shortcode attributes. This can lead to the execution of arbitrary JavaScript in the browsers of users who view the affected pages, potentially resulting in session hijacking, privilege escalation, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or limiting use of the 'givewp_campaign_comments' shortcode with user-supplied attributes. Monitor vendor channels for updates and apply official patches promptly once available.