CVE-2026-14318

Affected product: GiveWP WordPress plugin (before 4.16.3). Vulnerability: The donation-form template setting is not escaped before output into an HTML attribute, enabling stored XSS. Impact (as described): Users with the GiveWP Worker role and above can inject arbitrary web scripts that execute o...