CVE-2026-14987 is a stored cross-site scripting vulnerability in the GiveWP – Donation Plugin and Fundraising Platform for WordPress. The issue exists in the handling of the 'twitter_message' setting in the Sequoia template, where input is not properly sanitized or escaped before being embedded in JavaScript. Authenticated users with give worker-level privileges or above can exploit this to inject arbitrary scripts that execute when donors interact with the Share on Twitter button on the donation confirmation view. This vulnerability affects all versions up to and including 4.16.3. No official patch or remediation guidance has been published at this time.

An attacker with give worker-level access or higher can inject malicious JavaScript code that executes in the context of users visiting the affected pages. This can lead to information disclosure and integrity impacts, such as stealing session tokens or performing actions on behalf of users. The vulnerability does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and combined confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict give worker-level access to trusted users only and monitor for suspicious activity related to the Share on Twitter functionality. Avoid using the vulnerable 'twitter_message' setting if possible. Follow vendor updates closely for an official fix.