Skip to main content

Givewp CVE-2024-37099

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2024-08-19 audit@patchstack.com
Deserialization Givewp
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 19, 2024 - 17:15 nvd
CRITICAL 9.8

DescriptionNVD

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.

AnalysisAI

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Affected products include: Givewp. Version information: through 3.14.1..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Givewp

View all
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2024-5932 CRITICAL POC
9.8 Aug 20

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2025-0912 CRITICAL
9.8 Mar 04

The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.
CVE-2022-2260 MEDIUM POC
6.5 Aug 01

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exp
CVE-2022-0252 MEDIUM POC
6.1 Feb 21

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i
CVE-2021-24213 MEDIUM POC
6.1 Apr 12

The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-S
CVE-2019-9909 MEDIUM POC
6.1 Mar 22

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated me
CVE-2024-9634 CRITICAL
9.8 Oct 16

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2019-13578 CRITICAL
9.8 Aug 15

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical sever
CVE-2019-15317 MEDIUM POC
5.4 Aug 22

The give plugin before 2.4.7 for WordPress has XSS via a donor name. Rated medium severity (CVSS 5.4), this vulnerabilit
CVE-2020-20627 MEDIUM POC
5.3 Aug 31

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauth
CVE-2024-11921 MEDIUM POC
4.8 Dec 27

The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2017-3066 CRITICAL POC
9.8

Share

CVE-2024-37099 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy