CVE-2026-14318 Overview
CVE-2026-14318 is a stored Cross-Site Scripting (XSS) vulnerability in the GiveWP WordPress plugin before version 4.16.3. The plugin fails to escape a donation-form template setting before outputting the value inside an HTML attribute. Users assigned the GiveWP Worker role or above can inject arbitrary JavaScript that executes in the browser of any visitor who loads the public donation form. The flaw enables attackers with low-privilege authenticated access to target unauthenticated site visitors, including donors and administrators.
Critical Impact
Authenticated low-privilege users can persist JavaScript in public donation forms, enabling session theft, credential harvesting, and drive-by actions against every visitor rendering the affected form.
Affected Products
- GiveWP WordPress plugin versions prior to 4.16.3
- WordPress sites running GiveWP donation forms with users at Worker role or above
- Public-facing donation pages rendered by the vulnerable template setting
Discovery Timeline
- 2026-07-30 - CVE-2026-14318 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14318
Vulnerability Analysis
The vulnerability classifies as Cross-Site Scripting (XSS) [CWE-79], specifically a stored variant delivered through an HTML attribute context. GiveWP stores a donation-form template setting configurable from the plugin administration interface. When the plugin later renders the public donation form, it emits the stored value directly into an HTML attribute without applying attribute-context escaping such as esc_attr(). An attacker with the GiveWP Worker role or above supplies a payload that breaks out of the attribute using a quote character and appends an event handler or inline script. Every subsequent visitor to the donation form executes the injected JavaScript in the site origin.
Root Cause
The root cause is missing output encoding for user-controlled configuration data placed inside an HTML attribute. The plugin trusts the stored template setting and skips context-aware escaping at render time, violating WordPress secure-coding guidance that requires esc_attr() for attribute values.
Attack Vector
Exploitation requires authenticated access with the GiveWP Worker role or a higher role that can modify the affected donation-form template setting. The attacker submits a crafted value containing HTML-attribute-breaking characters and a JavaScript payload. The payload persists in the plugin configuration and executes for any unauthenticated visitor loading the donation form, including administrators previewing the page. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-14318
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs in GiveWP donation-form template settings stored in the WordPress options or plugin-specific tables.
- Outbound requests from visitor browsers to unfamiliar domains originating from donation-form pages.
- New or modified administrator accounts, session cookies exfiltrated in web server logs, or unexpected password resets shortly after donation-form views.
Detection Strategies
- Audit the WordPress database for GiveWP form template records containing HTML control characters such as ", <, >, or the string on followed by an event name.
- Enable Content Security Policy (CSP) reporting on donation pages to surface inline-script violations that indicate injected payloads.
- Review WordPress audit logs for changes to donation-form settings performed by Worker-level accounts.
Monitoring Recommendations
- Alert on modifications to GiveWP form configuration by non-administrator roles.
- Monitor donation-page HTTP responses for markup anomalies compared to a known-good baseline.
- Track authentication events for GiveWP Worker accounts, including credential changes and unusual login geolocations.
How to Mitigate CVE-2026-14318
Immediate Actions Required
- Upgrade the GiveWP plugin to version 4.16.3 or later on every WordPress site running the plugin.
- Review all users assigned the GiveWP Worker role or higher and revoke access for accounts that no longer need it.
- Inspect existing donation-form template settings and remove any values containing HTML or JavaScript payloads.
Patch Information
GiveWP addresses the issue in version 4.16.3 by applying attribute-context escaping to the donation-form template setting before output. Site operators should update through the WordPress plugin dashboard or by deploying the updated plugin package. Verify the installed version reports 4.16.3 or higher after the update.
Workarounds
- Temporarily restrict the GiveWP Worker role and higher to trusted operators until patching completes.
- Deploy a Web Application Firewall (WAF) rule that blocks HTML attribute-breaking characters in GiveWP configuration endpoints.
- Apply a strict Content Security Policy that disallows inline scripts on donation-form pages to reduce payload execution impact.
# Configuration example: verify GiveWP version via WP-CLI and update
wp plugin get give --field=version
wp plugin update give --version=4.16.3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
