What is GHSA-h33v-3fv3-7p55?

GHSA-h33v-3fv3-7p55 is a security advisory published by GitHub Security Advisories with Medium severity. The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting...

Which CVE IDs does GHSA-h33v-3fv3-7p55 cover?

GHSA-h33v-3fv3-7p55 covers the following CVE IDs: CVE-2026-14318. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h33v-3fv3-7p55?

GHSA-h33v-3fv3-7p55 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-h33v-3fv3-7p55MediumCVSS 6.8

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting...

Vendor

GitHub Security Advisories

Published

July 30, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-14318 →

📋 Description

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14318
https://wpscan.com/vulnerability/2957014f-542d-43fc-ad65-de236446eeeb
https://github.com/advisories/GHSA-h33v-3fv3-7p55