{"metadata": {"vulnerability": "cve-2026-97643", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-24T18:19:57.783Z", "date_only": false, "value": "2026-09-24T18:19:57.783Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-97643", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-24T18:35:03Z", "date_only": false, "value": "2026-09-24T18:35:03.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-97643", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-09T17:09:26Z", "date_only": false, "value": "2026-10-09T17:09:26.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-97643", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-10T05:31:04.713Z", "date_only": false, "value": "2026-10-10T05:31:04.713Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-97643", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-10T05:31:04.713Z", "date_only": false, "value": "2026-10-10T05:31:04.713Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "cve-2026-97643", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-10T05:59:57.758Z", "date_only": false, "value": "2026-10-10T05:59:57.758021Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117415083853896708", "record": "CVE-2026-97643", "field": "creation_timestamp", "uuid": "79fa4600-0d99-4a25-ac3c-6622b9af565a", "content": "CVE-2026-97643 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes The GiveWP \u2013 Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() \u2014 json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\nhttps://www.cve.org/CVERecord?id=CVE-2026-97643https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=cvehttps://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Blocks/CampaignGrid/render.php#L6https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L91https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/CampaignGridShortcode.php#L22https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Shortcodes/ShortcodeRenderController.php#L65https://plugins.trac.wordpress.org/browser/give/tags/4.17.0/src/Campaigns/Actions/RegisterCampaignShortcodes.php#L28https://github.com/impress-org/givewp/releases/tag/4.18.0#wordpress #stellarwp #GiveWP\u2013DonationPluginandFundraisingPlatform#CVE_2026_97643#bot", "url": "https://infosec.exchange/users/cve/statuses/117415083853896708"}, {"timestamp": "2026-10-10T06:16:45Z", "date_only": false, "value": "2026-10-10T06:16:45Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RX8R-4HQR-25GW", "record": "GHSA-RX8R-4HQR-25GW", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-10T06:16:45.547Z", "date_only": false, "value": "2026-10-10T06:16:45.547", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97643", "record": "FKIE_CVE-2026-97643", "field": "published"}, {"timestamp": "2026-10-10T06:31:00Z", "date_only": false, "value": "2026-10-10T06:31:00Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RX8R-4HQR-25GW", "record": "GHSA-RX8R-4HQR-25GW", "field": "published"}, {"timestamp": "2026-10-10T06:31:00Z", "date_only": false, "value": "2026-10-10T06:31:00Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RX8R-4HQR-25GW", "record": "GHSA-RX8R-4HQR-25GW", "field": "modified"}, {"timestamp": "2026-10-11T12:15:32.796Z", "date_only": false, "value": "2026-10-11T12:15:32.796431Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-97643", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-11T12:15:32.796Z", "date_only": false, "value": "2026-10-11T12:15:32.796431Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97643", "record": "FKIE_CVE-2026-97643", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-11T12:23:57.247Z", "date_only": false, "value": "2026-10-11T12:23:57.247Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-97643", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T12:23:57.247Z", "date_only": false, "value": "2026-10-11T12:23:57.247Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-97643", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:30:21.620Z", "date_only": false, "value": "2026-10-13T13:30:21.620", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-97643", "record": "FKIE_CVE-2026-97643", "field": "lastModified"}]}