CVE-2026-14318

GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

Medium · published July 30, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
36.3
In the wild
Unconfirmed
What it is

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00431 · 36.3th percentile
Published
2026-07-30T06:00Z
EPSS history
Timeline
  • 30 JUL 06:00Z
    GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
    cvelistv5