CVE-2026-14318 is a CWE-79 cross-site scripting vulnerability in the GiveWP WordPress plugin. The issue arises from improper escaping of a donation-form template setting before it is output in an HTML attribute. This allows users with the GiveWP Worker role and above to inject arbitrary web scripts, which then execute in the context of the public donation form viewed by any visitor. The vulnerability affects versions prior to 4.16.3. No CVSS score or official remediation level is provided in the available data.

An attacker with the GiveWP Worker role or higher can inject malicious scripts into the donation form, which will execute in the browsers of visitors to that form. This could lead to theft of user data, session hijacking, or other script-based attacks against visitors. The vulnerability requires authenticated access with a specific role, limiting exploitation to users with elevated permissions within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.16.3, upgrading to version 4.16.3 or later is likely the intended fix once confirmed. Until then, restrict GiveWP Worker role assignments to trusted users only and monitor for suspicious activity. Avoid granting elevated roles unnecessarily.