CVE-2026-14987 Overview
CVE-2026-14987 is a Stored Cross-Site Scripting (XSS) vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The flaw affects all versions up to and including 4.16.3. It stems from insufficient input sanitization and output escaping of the twitter_message Sequoia template setting. Authenticated attackers with give_worker-level access or higher can inject arbitrary JavaScript that executes when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view. The injected payload is evaluated inside a JavaScript template literal, allowing script execution in the donor's browser context.
Critical Impact
Authenticated contributors with give_worker privileges can persistently inject JavaScript that fires against donors during the post-donation Twitter share flow, enabling session theft, redirection, and administrative account takeover.
Affected Products
- GiveWP – Donation Plugin and Fundraising Platform for WordPress (all versions ≤ 4.16.3)
- Sequoia donation form template (social-sharing.php view)
- WordPress sites using the plugin with give_worker-level user accounts
Discovery Timeline
- 2026-07-16 - CVE-2026-14987 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-14987
Vulnerability Analysis
CVE-2026-14987 is a Stored Cross-Site Scripting flaw [CWE-79] rooted in the Sequoia donation form template. GiveWP allows administrators and users with the give_worker capability to configure per-form social sharing text through the metabox defined in class-metabox-form-data.php. The twitter_message value is persisted to the form's post meta without sufficient sanitization. When a donor completes a donation and reaches the Sequoia confirmation view, social-sharing.php renders that stored value directly into a JavaScript template literal. Because the value is neither HTML-escaped nor JavaScript-context escaped, an attacker-supplied payload breaks out of the literal and executes in the donor's browser.
Root Cause
The root cause is missing output escaping at the JavaScript sink in src/Views/Form/Templates/Sequoia/views/social-sharing.php line 41, combined with insufficient input filtering in the metabox handler and the give_clean formatting function. Values stored via the form metabox flow through generic string cleaning that does not neutralize characters meaningful to JavaScript template literals such as backticks, ${, or closing script sequences.
Attack Vector
An authenticated attacker with give_worker or higher access edits a donation form and sets the Twitter share message to a payload containing a JavaScript template-literal breakout. The malicious twitter_message is saved to the form's meta. When any subsequent donor completes a donation on that form and clicks the Share on Twitter button, the Sequoia template evaluates the payload as JavaScript in the donor's authenticated session context.
No exploitation code is published for CVE-2026-14987. Technical details are documented in the Wordfence Vulnerability Analysis and the fix is visible in the WordPress Give Changeset.
Detection Methods for CVE-2026-14987
Indicators of Compromise
- Unexpected script tags, backticks, or ${...} sequences inside the _give_form_template_settings post meta, specifically under the Sequoia template's twitter_message key.
- Outbound requests from donor browsers to unfamiliar domains immediately after clicking the Share on Twitter button on donation confirmation pages.
- Recent edits to donation forms performed by low-privilege give_worker accounts, particularly changes to social sharing configuration.
Detection Strategies
- Query the WordPress postmeta table for donation forms and inspect stored template settings for HTML tags, JavaScript keywords, or template-literal delimiters in twitter_message.
- Enable WordPress audit logging to capture form metabox saves by non-administrator accounts and alert on modifications to social sharing fields.
- Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to admin.php and post.php for script payloads targeting Give form fields.
Monitoring Recommendations
- Monitor donor confirmation page loads for Content Security Policy (CSP) violations that would indicate injected inline script execution.
- Track creation and privilege assignment of give_worker accounts and correlate with subsequent donation form edits.
- Aggregate WordPress access logs and alert on anomalous form save patterns from IP addresses not associated with staff.
How to Mitigate CVE-2026-14987
Immediate Actions Required
- Update the GiveWP plugin to a version newer than 4.16.3 that includes the fix from changeset 3607718.
- Audit all existing donation forms and remove any suspicious content from the twitter_message field before applying the patch.
- Review give_worker role assignments and revoke access for accounts that do not require form editing capability.
Patch Information
The vendor addressed CVE-2026-14987 in a subsequent GiveWP release. The corrective code is published in the WordPress Give Changeset 3607718, which applies escaping at the JavaScript sink in social-sharing.php and hardens the metabox input path referenced in class-metabox-form-data.php and formatting.php.
Workarounds
- Restrict form editing to trusted administrators by removing the give_worker role or downgrading its capabilities until the plugin is patched.
- Deploy a Content Security Policy that blocks inline script execution on donation confirmation pages to limit payload impact.
- Temporarily disable the Sequoia donation form template and switch affected forms to the Legacy template, which does not render twitter_message through the vulnerable JavaScript sink.
# Configuration example: verify installed GiveWP version and force update via WP-CLI
wp plugin get give --field=version
wp plugin update give
wp user list --role=give_worker --fields=ID,user_login,user_email
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
