https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T09:32:27.217405+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-85113 fkie_cve-2026-85113 2026-09-29T09:32:27.219354+00:00

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

 https://vulnerability.circl.lu/vuln/ghsa-4grg-xfv8-q8cj GHSA-4grg-xfv8-q8cj 2026-09-29T09:32:27.219418+00:00

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.