The givewp_campaign_grid shortcode in GiveWP versions up to and including 4.17.0 lacks proper input validation and output encoding for several user‑supplied attributes (filter_by, layout, sort_by, order_by). When an authenticated Contributor or higher creates a shortcode with malicious characters such as a single quote within the attribute values, the shortcode output embeds the attribute array via json_encode into a single‑quoted HTML attribute. Because json_encode does not escape single quotes, the attribute value can break out of its enclosing quote and inject arbitrary JavaScript. An attacker can therefore store malicious script code in the database that will execute whenever a visitor loads any page containing the affected shortcode, potentially enabling session hijacking, defacement, or other client‑side attacks.

The vulnerability impacts WordPress sites running the GiveWP “Donation Plugin and Fundraising Platform” from the vendor stellarwp. All releases with the plugin version 4.17.0 or earlier are affected. The plugin in question is provided as a WordPress plugin and the issue is limited to the shortcode processing logic.

The CVSS score is 6.4, indicating moderate severity. An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires the attacker to have Contributor‑level access or higher on the affected WordPress installation and the ability to add or modify shortcodes. Once a malicious shortcode is stored, the vulnerable script will run in the browsers of all users viewing the affected page, providing immediate cross‑site scripting capability. The threat vector is therefore local to the WordPress installation for authenticated users, but the impact is widespread for all site visitors.