CVE-2026-14318: GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

Q: Who can exploit this issue, and who is exposed to the injected script?

An authenticated user with the GiveWP Worker role or a higher GiveWP role can inject the script through donation-form template settings. The script executes when any visitor views the affected public donation form.

Q: Are sites running an older version affected by default?

The affected condition is present in GiveWP versions before 4.16.3 when a user with the required GiveWP role can modify the relevant donation-form template setting. The provided data does not establish whether that role or setting is enabled by default.

Q: How can I determine whether a site may already be affected?

Check whether GiveWP is below version 4.16.3 and review donation-form template settings for unexpected or suspicious attribute content. Also review accounts assigned the GiveWP Worker role or higher, since those roles can perform the injection.

Q: What can be done while an upgrade is not immediately possible?

Restrict GiveWP Worker and higher roles to trusted users, because those roles can modify the vulnerable setting. Review public donation forms and their template settings for injected content until the plugin can be updated to 4.16.3 or later.

Published Jul 30, 2026

Updated

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.

Affected Software

1 affected component

GiveWP GiveWP WordPress Plugin<4.16.3

Event History

Jul 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:25 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

An authenticated user with the GiveWP Worker role or a higher GiveWP role can inject the script through donation-form template settings. The script executes when any visitor views the affected public donation form.

Are sites running an older version affected by default?

The affected condition is present in GiveWP versions before 4.16.3 when a user with the required GiveWP role can modify the relevant donation-form template setting. The provided data does not establish whether that role or setting is enabled by default.

How can I determine whether a site may already be affected?

Check whether GiveWP is below version 4.16.3 and review donation-form template settings for unexpected or suspicious attribute content. Also review accounts assigned the GiveWP Worker role or higher, since those roles can perform the injection.

What can be done while an upgrade is not immediately possible?

Restrict GiveWP Worker and higher roles to trusted users, because those roles can modify the vulnerable setting. Review public donation forms and their template settings for injected content until the plugin can be updated to 4.16.3 or later.

CVE-2026-14318: GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

Are sites running an older version affected by default?

How can I determine whether a site may already be affected?

What can be done while an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the injected script?

Are sites running an older version affected by default?

How can I determine whether a site may already be affected?

What can be done while an upgrade is not immediately possible?