PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14987 stellarwp CVE debrief

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with give worker-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view. The vulnerability's impact is medium, with a CVSS score of 6.4, and it requires immediate attention to prevent potential attacks.

Vendor
stellarwp
Product
GiveWP – Donation Plugin and Fundraising Platform
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-16
Original CVE updated
2026-07-16
Advisory published
2026-07-16
Advisory updated
2026-07-16

Who should care

Authenticated attackers with give worker-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view.

Technical summary

The vulnerability exists in the 'twitter_message' Sequoia Template Setting of the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. Insufficient input sanitization and output escaping allow authenticated attackers with give worker-level access and above to inject arbitrary web scripts. These scripts execute when a user accesses an injected page, specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view.

Defensive priority

Medium priority due to the CVSS score of 6.4 and the potential for authenticated attackers to inject malicious scripts.

Recommended defensive actions

  • Apply patches or updates to the GiveWP – Donation Plugin and Fundraising Platform plugin to version 4.16.4 or later.
  • Restrict access to the plugin's settings and templates to prevent unauthorized modifications.
  • Monitor for suspicious activity, such as unusual script injections or Twitter share button interactions.
  • Implement additional security measures, such as input validation and output encoding, to prevent similar vulnerabilities.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-16T04:17:19.400Z and has not been modified since then. The NVD entry is currently 6.4, MEDIUM. The vulnerability was reported by [email protected]. The evidence is limited, and defenders should verify the affected scope and severity with the vendor and consider compensating controls.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-16T04:17:19.400Z and has not been modified since then.