Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Donation Plugin and Fundraising PlatformWP Affiliate Platformbuddyboss-platformWawpFundEngine – Donation and Crowdfunding PlatformCLUEVO LMS, E-Learning PlatformOttoKit: All-in-One Automation PlatformAdvanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Plugin · give
Donation Plugin and Fundraising Platform
97 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Donation Plugin and Fundraising Platform safe? The full page →
Oct 26, 2026GiveWP: Does not restrict the currency of a donation to the one the site or form acceptsCVE-2026-111974 · fixed in 4.19.0.1 · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Oct 25, 2026GiveWP: Does not perform a capability checkCVE-2026-111981 · fixed in 4.19.0.1 · reported by WPScanLow 2.7
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Oct 25, 2026GiveWP: Does not correctly determineCVE-2026-111980 · fixed in 4.19.0.1 · reported by WPScanMedium 5.5
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
Oct 25, 2026GiveWP: Does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attributeCVE-2026-111979 · fixed in 4.19.0.1 · reported by WPScanMedium 6.8
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
Oct 25, 2026GiveWP: Does not properly validate a user-supplied filename before reading it from diskCVE-2026-111978 · fixed in 4.19.0.1 · reported by WPScanMedium 6
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
Oct 25, 2026GiveWP: Does not perform any status or capability checkCVE-2026-111976 · fixed in 4.19.0.1 · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
Oct 10, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-97643 · affects up to 4.17.0 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Oct 9, 2026GiveWP: Authentication Bypass by SpoofingCVE-2026-96333 · affects up to 4.16.8.1 · reported by PatchstackHigh 7.5
Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.
Oct 8, 2026GiveWP: Missing AuthorizationCVE-2026-106600 · affects up to 4.18.0 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104672 · affects up to 4.17.0 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · affects up to 4.17.0 · reported by PatchstackHigh 8.1
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Oct 5, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · affects up to 4.17.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-97066 · affects up to 4.16.9 · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
Sep 30, 2026Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.CVE-2026-96834 · affects up to 4.16.9 · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-96830 · affects up to 4.16.9 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
Sep 30, 2026GiveWP: Improper Validation of Unsafe Equivalence in InputCVE-2026-97196 · affects up to 4.16.9 · reported by PatchstackCritical 9.1
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.
Sep 21, 2026GiveWP: Does not remove shortcode delimiters from donor-supplied values before rendering them on public pagesCVE-2026-85113 · fixed in 4.16.9 · reported by WPScanMedium 6.5
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
Sep 16, 2026GiveWP: Does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor upCVE-2026-85530 · fixed in 4.16.8.1 · reported by WPScanHigh 8.1
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
Aug 28, 2026GiveWP: Deserialization of Untrusted DataCVE-2026-82222 · affects up to 4.16.7.1 · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1.
Aug 28, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-5510 · affects up to 4.14.4 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · affects up to 4.16.5.1 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
Aug 13, 2026Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.CVE-2026-73357 · reported by PatchstackMedium 6.5
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.CVE-2026-66690 · affects up to 4.16.5 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
Jul 31, 2026GiveWP: Does not properly restrict access to a REST API endpoint that returns recurring-donation recordsCVE-2026-14319 · fixed in 4.16.3 · reported by WPScanHigh 7.5
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.
Jul 31, 2026GiveWP: Does not restrict the set of available payment gateways to those enabled by the administratorCVE-2026-14317 · fixed in 4.16.3 · reported by WPScanMedium 5.3
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.
Jul 30, 2026GiveWP: Does not escape a donation-form template setting before outputting it in an HTML attributeCVE-2026-14318 · fixed in 4.16.3 · reported by WPScanMedium 6.8
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.
Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.CVE-2026-65441 · affects up to 4.16.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · affects up to 4.16.3 · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
Jul 16, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-14987 · affects up to 4.16.3 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-13704 · affects up to 4.16.1 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-13246 · affects up to 4.16.0 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2026GiveWP: Cross-Site Request ForgeryCVE-2026-11981 · affects up to 4.15.3 · reported by WordfenceMedium 4.3
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · affects up to 4.14.2 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
Jun 1, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42678 · affects up to 4.14.5 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5.
Apr 29, 2026GiveWP: Missing AuthorizationCVE-2026-42642 · affects up to 4.14.5 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.
Dec 9, 2025GiveWP: Cross-Site Request Forgery (CSRF)CVE-2025-67467 · affects up to 4.13.1 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13.1.
Dec 9, 2025GiveWP: Improper Control of Generation of Code ('Code Injection')CVE-2025-66533 · affects up to 4.13.1 · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.
Nov 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-13206 · affects up to 4.13.0 · reported by WordfenceHigh 7.2
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-11228 · affects up to 4.10.0 · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-11227 · affects up to 4.10.0 · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 21, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-7221 · affects up to 4.5.0 · reported by WordfenceMedium 4.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · affects up to 4.6.0 · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Jul 31, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-7205 · affects up to 4.5.0 · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · affects up to 4.3.0 · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 22, 2025GiveWP – Donation Plugin and Fundraising Platform: Sensitive Information ExposureCVE-2025-2331 · affects up to 3.22.1 · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 15, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2025-2025 · affects up to 3.22.0 · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 3, 2025Donations Widget: PHP Object InjectionCVE-2025-0912 · affects up to 3.19.4 · reported by WordfenceCritical 9.8
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Jan 13, 2025GiveWP: Deserialization of Untrusted DataCVE-2025-22777 · affects up to 3.19.3 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
Jan 11, 2025GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-12877 · affects up to 3.19.2 · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-23672 · affects up to 2.25.1 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-47183 · affects up to 2.33.1 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.
Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · fixed in 3.19.0 · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Oct 15, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-9634 · affects up to 3.16.3 · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-8353 · affects up to 3.16.1 · reported by WordfenceCritical 9.8
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: Time-based SQL InjectionCVE-2024-9130 · affects up to 3.16.1 · reported by WordfenceHigh 7.2
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.
Sep 25, 2024GiveWP: Cross-Site Request Forgery (CSRF)CVE-2024-47315 · affects up to 3.15.1 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1.
Aug 29, 2024GiveWP – Donation Plugin and Fundraising Platform: Full Path DisclosureCVE-2024-6551 · affects up to 3.15.1 · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access and deletion of dataCVE-2024-5941 · affects up to 3.14.1 · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2024-5940 · affects up to 3.13.0 · reported by WordfenceMedium 6.5
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2024-5939 · affects up to 3.13.0 · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-5932 · affects up to 3.14.1 · reported by WordfenceCritical 10
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-37099 · affects up to 3.14.1 · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.
Jul 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Insecure Direct Object ReferenceCVE-2024-5977 · affects up to 3.13.0 · reported by WordfenceMedium 5.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 8, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35679 · affects up to 3.12.0 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.12.0.
May 18, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-3714 · affects up to 3.10.0 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
May 17, 2024GiveWP: Improper Privilege ManagementCVE-2023-41665 · affects up to 2.33.0 · reported by PatchstackHigh 8.8
Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0.
Apr 12, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1957 · affects up to 3.6.1 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Apr 12, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-40211 · affects up to 2.25.1 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from n/a through 2.25.1.
Apr 9, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1424 · affects up to 3.5.1 · reported by WordfenceMedium 6.4
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 28, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-30229 · affects up to 3.4.2 · reported by PatchstackHigh 8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2.
Mar 15, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27987 · affects up to 3.3.1 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.3.1.
Feb 10, 2024GiveWP – Donation Plugin and Fundraising Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51415 · affects up to 3.2.2 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2.
Jan 16, 2024GiveWP: Does not properly escape user input before it reaches SQL queriesCVE-2023-0224 · fixed in 2.24.1 · reported by WPScanCritical 9.8
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks
Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4248 · affects up to 2.33.3 · reported by WordfenceMedium 5.4
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4247 · affects up to 2.33.3 · reported by WordfenceMedium 5.4
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4246 · affects up to 2.33.3 · reported by WordfenceMedium 4.3
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 28, 2023GiveWP – Donation Plugin and Fundraising Platform: Deserialization of Untrusted DataCVE-2023-32513 · affects up to 2.25.3 · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
Dec 18, 2023GiveWP – Donation Plugin and Fundraising Platform: Server-Side Request Forgery (SSRF)CVE-2022-40312 · affects up to 2.25.1 · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
Nov 7, 2023GiveWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-22719 · affects up to 2.25.1 · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Jun 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.CVE-2023-25450 · fixed in 2.25.2 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.
May 8, 2023Auth.CVE-2023-23668 · affects up to 2.25.1 · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.
Feb 13, 2023GiveWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4448 · fixed in 2.24.0 · reported by WPScanMedium 5.4
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Aug 1, 2022GiveWP: Does not have CSRF in placeCVE-2022-2260 · fixed in 2.21.3 · reported by WPScanMedium 6.5
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · fixed in 2.21.3 · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · affects up to 2.20.2 · reported by PatchstackMedium 5.5
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Jul 21, 2022Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-28700 · affects up to 2.20.2 · reported by PatchstackCritical 9.1
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Jul 18, 2022GiveWP: Sensitive Information DisclosureCVE-2022-2117 · affects up to 2.20.2 · reported by WordfenceMedium 5.3
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · fixed in 2.17.3 · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · fixed in 2.17.3 · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · fixed in 2.17.3 · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Aug 23, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not escape the Donation Level setting of its Donation FormsCVE-2021-24524 · fixed in 2.12.0 · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · fixed in 2.10.4 · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · fixed in 2.10.0 · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
Aug 22, 2019The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-15317 · fixed in 2.4.7 · reported by MITREMedium 5.4
The give plugin before 2.4.7 for WordPress has XSS via a donor name.
Mar 21, 2019The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-9909 · fixed in 2.3.1 · reported by MITREMedium 6.1
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.