This vulnerability is a code injection flaw (CWE‑94) that occurs when the GiveWP plugin processes user supplied shortcode data without proper validation. If an attacker can insert crafted code into the plugin’s shortcode handling, the code is executed on the site, potentially allowing the attacker to run arbitrary commands, exfiltrate data, or modify site content, thus compromising confidentiality, integrity, and availability.

The defect is present in StellarWP GiveWP for WordPress in all releases through and including version 4.13.1. Any WordPress installation that has the GiveWP plugin at a version equal to or lower than 4.13.1 is therefore vulnerable.

The CVSS score of 6.5 places the risk in the moderate range, and the EPSS score of less than 1% suggests that exploitation is unlikely to occur in the near term. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would require the attacker to embed malicious code within a shortcode and deliver it to the plugin, a scenario most likely to arise through user‑submitted content or a compromised administrative account. While the probability of exploitation remains low, the potential impact of successful code execution is significant.