CVE-2026-14318
GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
CVSS Score
6.8
EPSS Score
0.2%
EPSS Percentile
7th
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
| Vendor | unknown |
| Product | givewp |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown givewp
Be the first to know when new medium vulnerabilities affecting unknown givewp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / GiveWP
0 < 4.16.3
References
Credits
Meher Sudhakar Abbireddi WPScan