Is GiveWP safe?

Every recorded flaw

• Oct 26, 2026GiveWP: Does not restrict the currency of a donation to the one the site or form acceptsCVE-2026-111974 · fixed in 4.19.0.1 · reported by WPScanMedium 5.3
• Oct 25, 2026GiveWP: Does not perform a capability checkCVE-2026-111981 · fixed in 4.19.0.1 · reported by WPScanLow 2.7
• Oct 25, 2026GiveWP: Does not correctly determineCVE-2026-111980 · fixed in 4.19.0.1 · reported by WPScanMedium 5.5
• Oct 25, 2026GiveWP: Does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attributeCVE-2026-111979 · fixed in 4.19.0.1 · reported by WPScanMedium 6.8
• Oct 25, 2026GiveWP: Does not properly validate a user-supplied filename before reading it from diskCVE-2026-111978 · fixed in 4.19.0.1 · reported by WPScanMedium 6
• Oct 25, 2026GiveWP: Does not perform any status or capability checkCVE-2026-111976 · fixed in 4.19.0.1 · reported by WPScanMedium 5.3
• Oct 10, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-97643 · affects up to 4.17.0 · reported by WordfenceMedium 6.4
• Oct 9, 2026GiveWP: Authentication Bypass by SpoofingCVE-2026-96333 · affects up to 4.16.8.1 · reported by PatchstackHigh 7.5
• Oct 8, 2026GiveWP: Missing AuthorizationCVE-2026-106600 · affects up to 4.18.0 · reported by PatchstackMedium 5.3
• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104672 · affects up to 4.17.0 · reported by PatchstackHigh 7.1
• Oct 6, 2026Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.CVE-2026-104405 · affects up to 4.17.0 · reported by PatchstackHigh 8.1
• Oct 5, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104404 · affects up to 4.17.0 · reported by PatchstackMedium 6.5
• Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-97066 · affects up to 4.16.9 · reported by PatchstackMedium 5.3
• Sep 30, 2026Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.CVE-2026-96834 · affects up to 4.16.9 · reported by PatchstackMedium 6.5
• Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.CVE-2026-96830 · affects up to 4.16.9 · reported by PatchstackHigh 7.1
• Sep 30, 2026GiveWP: Improper Validation of Unsafe Equivalence in InputCVE-2026-97196 · affects up to 4.16.9 · reported by PatchstackCritical 9.1
• Sep 21, 2026GiveWP: Does not remove shortcode delimiters from donor-supplied values before rendering them on public pagesCVE-2026-85113 · fixed in 4.16.9 · reported by WPScanMedium 6.5
• Sep 16, 2026GiveWP: Does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor upCVE-2026-85530 · fixed in 4.16.8.1 · reported by WPScanHigh 8.1
• Aug 28, 2026GiveWP: Deserialization of Untrusted DataCVE-2026-82222 · affects up to 4.16.7.1 · reported by Patchstack2.3% oddsCritical 10
• Aug 28, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-5510 · affects up to 4.14.4 · reported by WordfenceMedium 6.4
• Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · affects up to 4.16.5.1 · reported by PatchstackMedium 6.5
• Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · reported by PatchstackMedium 6.5
• Aug 13, 2026Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.CVE-2026-73357 · reported by PatchstackMedium 6.5
• Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · reported by PatchstackMedium 5.3
• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.CVE-2026-66690 · affects up to 4.16.5 · reported by PatchstackHigh 7.1
• Jul 31, 2026GiveWP: Does not properly restrict access to a REST API endpoint that returns recurring-donation recordsCVE-2026-14319 · fixed in 4.16.3 · reported by WPScanHigh 7.5
• Jul 31, 2026GiveWP: Does not restrict the set of available payment gateways to those enabled by the administratorCVE-2026-14317 · fixed in 4.16.3 · reported by WPScanMedium 5.3
• Jul 30, 2026GiveWP: Does not escape a donation-form template setting before outputting it in an HTML attributeCVE-2026-14318 · fixed in 4.16.3 · reported by WPScanMedium 6.8
• Jul 27, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.CVE-2026-65441 · affects up to 4.16.3 · reported by PatchstackHigh 7.1
• Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-65464 · affects up to 4.16.3 · reported by PatchstackMedium 5.4
• Jul 16, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-14987 · affects up to 4.16.3 · reported by WordfenceMedium 6.4
• Jul 2, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-13704 · affects up to 4.16.1 · reported by WordfenceMedium 6.4
• Jul 1, 2026GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2026-13246 · affects up to 4.16.0 · reported by WordfenceMedium 6.4
• Jul 1, 2026GiveWP: Cross-Site Request ForgeryCVE-2026-11981 · affects up to 4.15.3 · reported by WordfenceMedium 4.3
• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · affects up to 4.14.2 · reported by PatchstackHigh 7.1
• Jun 1, 2026GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42678 · affects up to 4.14.5 · reported by PatchstackHigh 7.1
• Apr 29, 2026GiveWP: Missing AuthorizationCVE-2026-42642 · affects up to 4.14.5 · reported by PatchstackMedium 5.3
• Dec 9, 2025GiveWP: Cross-Site Request Forgery (CSRF)CVE-2025-67467 · affects up to 4.13.1 · reported by PatchstackMedium 5.4
• Dec 9, 2025GiveWP: Improper Control of Generation of Code ('Code Injection')CVE-2025-66533 · affects up to 4.13.1 · reported by PatchstackMedium 6.5
• Nov 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-13206 · affects up to 4.13.0 · reported by WordfenceHigh 7.2
• Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-11228 · affects up to 4.10.0 · reported by WordfenceMedium 5.3
• Oct 3, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-11227 · affects up to 4.10.0 · reported by WordfenceMedium 6.5
• Aug 21, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2025-7221 · affects up to 4.5.0 · reported by WordfenceMedium 4.3
• Aug 6, 2025GiveWP – Donation Plugin and Fundraising Platform: Information ExposureCVE-2025-8620 · affects up to 4.6.0 · reported by WordfenceMedium 5.3
• Jul 31, 2025GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2025-7205 · affects up to 4.5.0 · reported by WordfenceMedium 5.4
• Jun 19, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized view and modification of dataCVE-2025-4571 · affects up to 4.3.0 · reported by WordfenceMedium 5.4
• Mar 22, 2025GiveWP – Donation Plugin and Fundraising Platform: Sensitive Information ExposureCVE-2025-2331 · affects up to 3.22.1 · reported by WordfenceMedium 5.3
• Mar 15, 2025GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2025-2025 · affects up to 3.22.0 · reported by WordfenceMedium 6.5
• Mar 3, 2025Donations Widget: PHP Object InjectionCVE-2025-0912 · affects up to 3.19.4 · reported by Wordfence1.4% oddsCritical 9.8
• Jan 13, 2025GiveWP: Deserialization of Untrusted DataCVE-2025-22777 · affects up to 3.19.3 · reported by PatchstackCritical 9.8
• Jan 11, 2025GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-12877 · affects up to 3.19.2 · reported by Wordfence1.2% oddsCritical 9.8
• Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-23672 · affects up to 2.25.1 · reported by PatchstackMedium 5.4
• Jan 2, 2025GiveWP: Missing AuthorizationCVE-2023-47183 · affects up to 2.33.1 · reported by PatchstackMedium 5.3
• Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · fixed in 3.19.0 · reported by WPScanMedium 4.8
• Oct 15, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-9634 · affects up to 3.16.3 · reported by Wordfence1.4% oddsCritical 9.8
• Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-8353 · affects up to 3.16.1 · reported by Wordfence32% oddsCritical 9.8
• Sep 27, 2024GiveWP – Donation Plugin and Fundraising Platform: Time-based SQL InjectionCVE-2024-9130 · affects up to 3.16.1 · reported by WordfenceHigh 7.2
• Sep 25, 2024GiveWP: Cross-Site Request Forgery (CSRF)CVE-2024-47315 · affects up to 3.15.1 · reported by PatchstackMedium 5.4
• Aug 29, 2024GiveWP – Donation Plugin and Fundraising Platform: Full Path DisclosureCVE-2024-6551 · affects up to 3.15.1 · reported by WordfenceMedium 5.3
• Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access and deletion of dataCVE-2024-5941 · affects up to 3.14.1 · reported by WordfenceMedium 5.4
• Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized modification of dataCVE-2024-5940 · affects up to 3.13.0 · reported by WordfenceMedium 6.5
• Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Unauthorized access of dataCVE-2024-5939 · affects up to 3.13.0 · reported by WordfenceMedium 5.3
• Aug 19, 2024GiveWP – Donation Plugin and Fundraising Platform: PHP Object InjectionCVE-2024-5932 · affects up to 3.14.1 · reported by Wordfence77% oddsCritical 10
• Aug 19, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-37099 · affects up to 3.14.1 · reported by PatchstackCritical 10
• Jul 19, 2024GiveWP – Donation Plugin and Fundraising Platform: Insecure Direct Object ReferenceCVE-2024-5977 · affects up to 3.13.0 · reported by WordfenceMedium 5.4
• Jun 8, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-35679 · affects up to 3.12.0 · reported by PatchstackHigh 7.1
• May 18, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-3714 · affects up to 3.10.0 · reported by WordfenceMedium 6.4
• May 17, 2024GiveWP: Improper Privilege ManagementCVE-2023-41665 · affects up to 2.33.0 · reported by PatchstackHigh 8.8
• Apr 12, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1957 · affects up to 3.6.1 · reported by WordfenceMedium 6.4
• Apr 12, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-40211 · affects up to 2.25.1 · reported by PatchstackMedium 5.9
• Apr 9, 2024GiveWP – Donation Plugin and Fundraising Platform: Stored Cross-Site ScriptingCVE-2024-1424 · affects up to 3.5.1 · reported by WordfenceMedium 6.4
• Mar 28, 2024GiveWP: Deserialization of Untrusted DataCVE-2024-30229 · affects up to 3.4.2 · reported by PatchstackHigh 8
• Mar 15, 2024GiveWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27987 · affects up to 3.3.1 · reported by PatchstackHigh 7.1
• Feb 10, 2024GiveWP – Donation Plugin and Fundraising Platform: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51415 · affects up to 3.2.2 · reported by PatchstackMedium 6.5
• Jan 16, 2024GiveWP: Does not properly escape user input before it reaches SQL queriesCVE-2023-0224 · fixed in 2.24.1 · reported by WPScan3.7% oddsCritical 9.8
• Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4248 · affects up to 2.33.3 · reported by WordfenceMedium 5.4
• Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4247 · affects up to 2.33.3 · reported by WordfenceMedium 5.4
• Jan 11, 2024GiveWP: Cross-Site Request ForgeryCVE-2023-4246 · affects up to 2.33.3 · reported by WordfenceMedium 4.3
• Dec 28, 2023GiveWP – Donation Plugin and Fundraising Platform: Deserialization of Untrusted DataCVE-2023-32513 · affects up to 2.25.3 · reported by PatchstackHigh 7.5
• Dec 18, 2023GiveWP – Donation Plugin and Fundraising Platform: Server-Side Request Forgery (SSRF)CVE-2022-40312 · affects up to 2.25.1 · reported by PatchstackMedium 5.5
• Nov 7, 2023GiveWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-22719 · affects up to 2.25.1 · reported by PatchstackMedium 4.7
• Jun 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.CVE-2023-25450 · fixed in 2.25.2 · reported by PatchstackMedium 5.4
• May 8, 2023Auth.CVE-2023-23668 · affects up to 2.25.1 · reported by PatchstackMedium 6.5
• Feb 13, 2023GiveWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4448 · fixed in 2.24.0 · reported by WPScanMedium 5.4
• Aug 1, 2022GiveWP: Does not have CSRF in placeCVE-2022-2260 · fixed in 2.21.3 · reported by WPScanMedium 6.5
• Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · fixed in 2.21.3 · reported by WPScanMedium 4.8
• Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · affects up to 2.20.2 · reported by PatchstackMedium 5.5
• Jul 21, 2022Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-28700 · affects up to 2.20.2 · reported by Patchstack2.1% oddsCritical 9.1
• Jul 18, 2022GiveWP: Sensitive Information DisclosureCVE-2022-2117 · affects up to 2.20.2 · reported by Wordfence1.2% oddsMedium 5.3
• Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · fixed in 2.17.3 · reported by WPScanMedium 6.1
• Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · fixed in 2.17.3 · reported by WPScanMedium 6.1
• Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · fixed in 2.17.3 · reported by WPScan2.1% oddsMedium 6.1
• Aug 23, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not escape the Donation Level setting of its Donation FormsCVE-2021-24524 · fixed in 2.12.0 · reported by WPScanMedium 4.8
• May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · fixed in 2.10.4 · reported by WPScanMedium 4.8
• Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · fixed in 2.10.0 · reported by WPScan1.4% oddsMedium 6.1
• Aug 22, 2019The give plugin before 2.4.7 for WordPress has XSS via a donor name.CVE-2019-15317 · fixed in 2.4.7 · reported by MITRE1.2% oddsMedium 5.4
• Mar 21, 2019The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.CVE-2019-9909 · fixed in 2.3.1 · reported by MITRE1.4% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.