What is the CVSS score of CVE-2026-14318?

CVE-2026-14318 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14318?

Yes, a public proof-of-concept exploit is available for CVE-2026-14318. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14318?

Yes, a patch is available for CVE-2026-14318. Update the affected software to the latest version immediately.

GiveWP CVE-2026-14318

EUVD-2026-50995 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 WPScan

GHSA-h33v-3fv3-7p55

WordPress XSS Givewp Unknown

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

PR:H reflects mandatory GiveWP Worker role; A:L substituted for A:H as stored XSS has no direct availability impact on the server.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:38 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

6.8 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 6.8

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.

AnalysisAI

Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.

Technical ContextAI

GiveWP is a WordPress plugin designed for managing charitable donation campaigns and forms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an unsanitized write-to-HTML-attribute path: a donation-form template setting accepts user-supplied content that is reflected into an HTML attribute without proper encoding or escaping. Because the output context is an HTML attribute rather than plain text, standard WordPress content filters may not apply, and an attacker can break out of the attribute value using quote characters to inject event handlers or script tags. The affected CPE is cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:*, covering all GiveWP releases prior to 4.16.3. The stored nature of the payload means a single injection persists and fires for every subsequent visitor without further attacker interaction.

RemediationAI

Upgrade GiveWP to version 4.16.3 or later, which is the vendor-released patch confirmed by WPScan and EUVD-2026-50995; the fix can be applied via the standard WordPress plugin update mechanism from the dashboard or WP-CLI. Advisory references: https://wpscan.com/vulnerability/2957014f-542d-43fc-ad65-de236446eeeb/ and https://nvd.nist.gov/vuln/detail/CVE-2026-14318. If immediate upgrade is not possible, the most effective compensating control is to audit and revoke the GiveWP Worker role from any account that does not strictly require it, since the vulnerability requires that role at minimum. A secondary control is to implement a Content Security Policy header on the donation form page that blocks inline script execution; this mitigates the impact of injected payloads but introduces potential compatibility issues with legitimate GiveWP JavaScript. Monitoring donation-form template settings for unexpected HTML attribute injection patterns via a WAF or file-integrity solution can provide detection coverage until the patch is applied.