CVE-2026-5510: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in stellarwp GiveWP – Donation Plugin and Fundraising Platform

CVE-2026-5510 is a stored cross-site scripting vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. It affects all versions up to and including 4.14.4. The issue stems from insufficient input sanitization and output escaping of the continue_button_title and display_style attributes in the 'give_form' shortcode. Although sanitize_text_field() is applied, it does not properly escape these inputs when rendered in HTML data attributes, enabling authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript that executes in the context of users visiting the injected pages.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject malicious scripts into pages using the 'give_form' shortcode. This can lead to the execution of arbitrary JavaScript in the browsers of users who view these pages, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or remediation has been confirmed yet. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the 'give_form' shortcode usage where possible to reduce exposure.