CVE-2026-14318 — GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role…
Published: 2026-07-30 · CVSS: 6.8 · CVSS 3.1
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7