CVE-2026-14318: GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
An authenticated user with the GiveWP Worker role or a higher GiveWP role can inject the script through donation-form template settings. The script executes when any visitor views the affected public donation form.
Are sites running an older version affected by default?
The affected condition is present in GiveWP versions before 4.16.3 when a user with the required GiveWP role can modify the relevant donation-form template setting. The provided data does not establish whether that role or setting is enabled by default.
How can I determine whether a site may already be affected?
Check whether GiveWP is below version 4.16.3 and review donation-form template settings for unexpected or suspicious attribute content. Also review accounts assigned the GiveWP Worker role or higher, since those roles can perform the injection.
What can be done while an upgrade is not immediately possible?
Restrict GiveWP Worker and higher roles to trusted users, because those roles can modify the vulnerable setting. Review public donation forms and their template settings for injected content until the plugin can be updated to 4.16.3 or later.