The GiveWP WordPress plugin before version 4.16.9 does not remove shortcode delimiters from values supplied by donors before rendering them on public pages. An attacker can embed a shortcode in the donor name field, and because the plugin’s stripping routine can be defeated by nesting, the embedded shortcode is interpreted and executed. This flaw gives an unauthenticated user the ability to run any shortcode that the site owner has registered, which could lead to the execution of unintended code on the site.

WordPress installations that have the GiveWP plugin installed with a version earlier than 4.16.9. Public pages that display or process donor name input are susceptible. The vulnerability is independent of user role and requires no authentication.

The CVSS base score of 6.5 indicates a medium severity risk, and the EPSS score of <1% shows a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the affected functionality through the public internet, and the flaw can be triggered simply by submitting a form with a specially crafted donor name; no further privileges are required.