Givewp
Monthly
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Unauthenticated reflected cross-site scripting in the GiveWP WordPress donation plugin (versions ≤4.14.2) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the user clicks a crafted link. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36921; no public exploit identified at time of analysis, and the CVSS scope-change rating of 7.1 reflects potential session hijacking or administrative action abuse against logged-in WordPress users including site administrators.
DOM-based cross-site scripting in the GiveWP WordPress donation plugin (versions up to and including 4.14.5) allows remote attackers to execute arbitrary JavaScript in a victim's browser session after the victim interacts with an attacker-supplied link or page element. The flaw carries a CVSS 7.1 score driven by changed scope (S:C), meaning impact extends beyond the vulnerable component into the surrounding WordPress site context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
GiveWP versions up to and including 4.16.9 expose sensitive donor-related data to any authenticated low-privilege user, because a plugin endpoint performs no authorization check before returning the data. The issue is a broken access control flaw (CWE-862) rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack, meaning an attacker needs only a Subscriber-level account and no user interaction, with confidentiality as the sole impacted metric. Sites that leave WordPress self-registration open are the most exposed, while sites with registration disabled and no attacker-controlled low-privilege accounts are substantially harder to exploit; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated shortcode injection in the GiveWP WordPress donation plugin before version 4.16.9 lets any site visitor submit nested shortcode delimiters through a public donation form, causing the site to execute arbitrary registered shortcodes when the donor-supplied value is rendered. Real-world impact is bounded by which shortcodes are registered on the target: a site with only benign shortcodes suffers little, while one exposing sensitive or administrative shortcodes could face data exposure or content manipulation. No public exploit code identified at time of analysis and the issue is not in CISA KEV; severity is moderate (CVSS 6.5, unauthenticated, no user interaction).
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Missing authorization in GiveWP (StellarWP's WordPress donation plugin) versions through 4.14.5 permits unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control levels, resulting in partial information disclosure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the SSVC framework rates the attack as automatable - meaning mass scanning is trivially feasible if a public exploit emerges. No public exploit or active exploitation has been identified at time of analysis; EPSS places exploitation probability at just 0.03% (8th percentile), indicating low current real-world risk despite the accessible attack surface.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status(). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP allows Object Injection.19.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.5%.
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.25.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in GiveWP GiveWP allows Exploiting Incorrectly Configured Access Control Security Levels.33.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.15.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest'. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.12.0. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.25.1. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.4.2. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.3.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform.25.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform.25.1. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in StellarWP GiveWP give.25.1. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The give plugin before 2.4.7 for WordPress has XSS via a donor name. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Payment bypass in GiveWP WordPress plugin through 4.16.8.1 allows unauthenticated remote attackers to have donations accepted without a legitimately cleared payment. This CWE-290 spoofing flaw has a CVSS score of 7.5, but impact is limited to donation/transaction integrity; it does not grant WordPress authentication, admin access, or server control. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS data is not provided.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
Improper privilege management in the GiveWP WordPress donation plugin (affected ranging from 4.16.6 up to but not including 4.16.8.1) lets unauthenticated remote attackers be mis-resolved as an arbitrary donor and then set the WordPress account password of any user linked to that donor record, up to and including an administrator. The root cause is CWE-269: the plugin does not consistently normalise donor e-mail addresses between the value it stores and the value it later uses for donor lookup, so a crafted e-mail string (case, whitespace, or alias/dot variations) can collide with a privileged donor identity. Exploitation is confirmed feasible - publicly available exploit code exists via WPScan and no authentication or user interaction is required - although the AC:H factor and low EPSS (0.18%, 8th percentile) indicate a targeted rather than mass-exploitation profile; there is no CISA KEV entry, so active exploitation is not confirmed. Vendor-released patch: 4.16.8.1.
Unauthenticated PHP object injection in the GiveWP WordPress donation plugin (all versions through 4.16.7.1) lets remote attackers reach a deserialization sink and chain it into remote code execution on the hosting server. The flaw is network-reachable with no authentication or user interaction and carries a maximum CVSS of 10.0; Patchstack's public write-up details the full object-injection-to-RCE chain, though no in-the-wild exploitation has been confirmed. Because GiveWP handles donation and payment workflows, a successful attack fully compromises the site and any donor data it processes.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Unauthenticated reflected cross-site scripting in the GiveWP WordPress donation plugin (versions ≤4.14.2) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the user clicks a crafted link. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36921; no public exploit identified at time of analysis, and the CVSS scope-change rating of 7.1 reflects potential session hijacking or administrative action abuse against logged-in WordPress users including site administrators.
DOM-based cross-site scripting in the GiveWP WordPress donation plugin (versions up to and including 4.14.5) allows remote attackers to execute arbitrary JavaScript in a victim's browser session after the victim interacts with an attacker-supplied link or page element. The flaw carries a CVSS 7.1 score driven by changed scope (S:C), meaning impact extends beyond the vulnerable component into the surrounding WordPress site context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.9%.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
GiveWP, a WordPress donation and fundraising plugin, ships with a missing-authorization flaw (CWE-862) in versions through 4.18.0 that allows remote attackers to perform unauthorized actions against plugin-scoped data without authenticating or interacting with a victim. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confines impact to a limited integrity loss with no confidentiality or availability effect, so the realistic outcome is unauthorized modification of donation-related or plugin configuration data rather than full site compromise. Any internet-reachable WordPress installation running the affected range is exposed by default; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is tracked by Patchstack and as EUVD-2026-94928.
Stored cross-site scripting in the GiveWP WordPress donation plugin (versions through 4.17.0) lets an authenticated user with only low-level privileges persist a script payload that executes in the browser of any user who later views the affected page. Because the injected code runs in the origin of the WordPress site (CVSS scope change: S:C), an attacker who convinces an administrator to open the poisoned screen can steal session cookies, harvest nonces, or perform privileged actions as that administrator. A vendor/Patchstack CVSS 3.1 base score of 6.5 (Medium) applies, exploitation requires an authenticated account plus victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
GiveWP versions up to and including 4.16.9 expose sensitive donor-related data to any authenticated low-privilege user, because a plugin endpoint performs no authorization check before returning the data. The issue is a broken access control flaw (CWE-862) rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) by Patchstack, meaning an attacker needs only a Subscriber-level account and no user interaction, with confidentiality as the sole impacted metric. Sites that leave WordPress self-registration open are the most exposed, while sites with registration disabled and no attacker-controlled low-privilege accounts are substantially harder to exploit; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated shortcode injection in the GiveWP WordPress donation plugin before version 4.16.9 lets any site visitor submit nested shortcode delimiters through a public donation form, causing the site to execute arbitrary registered shortcodes when the donor-supplied value is rendered. Real-world impact is bounded by which shortcodes are registered on the target: a site with only benign shortcodes suffers little, while one exposing sensitive or administrative shortcodes could face data exposure or content manipulation. No public exploit code identified at time of analysis and the issue is not in CISA KEV; severity is moderate (CVSS 6.5, unauthenticated, no user interaction).
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP, the WordPress donation management plugin, allows unauthenticated remote attackers to perform unauthorized integrity-affecting actions against installations running versions prior to 4.16.6. Rooted in CWE-862 (Missing Authorization), the flaw is network-exploitable with no authentication and low attack complexity, making it trivially automatable at scale against the plugin's widespread nonprofit and charity WordPress install base. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated vector warrants prompt patching given the plugin's broad deployment footprint.
GiveWP WordPress donation plugin before version 4.16.3 allows unauthenticated users to route donations through payment gateways the administrator has explicitly disabled, by supplying a gateway identifier via request input that the plugin fails to validate against the admin-configured allowlist. Rooted in CWE-862 (Missing Authorization), this bypasses financial controls that site operators may have disabled for compliance, fraud prevention, or contractual reasons - making the practical business risk higher than the CVSS Medium score suggests. A publicly available proof-of-concept exists via WPScan; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.
Cross-Site Request Forgery in GiveWP WordPress donation plugin versions up to and including 4.16.3 enables unauthenticated remote attackers to forge requests on behalf of authenticated administrators, resulting in limited integrity and availability impact on the affected installation. The CVSS vector (PR:N/UI:R) confirms the attacker requires no server-side credentials but must social-engineer a logged-in victim into triggering the forged request. No active exploitation is confirmed - this CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis.
Missing authorization in GiveWP (StellarWP's WordPress donation plugin) versions through 4.14.5 permits unauthenticated remote attackers to access restricted functionality due to incorrectly configured access control levels, resulting in partial information disclosure. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and the SSVC framework rates the attack as automatable - meaning mass scanning is trivially feasible if a public exploit emerges. No public exploit or active exploitation has been identified at time of analysis; EPSS places exploitation probability at just 0.03% (8th percentile), indicating low current real-world risk despite the accessible attack surface.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status(). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP allows Object Injection.19.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.5%.
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.25.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in GiveWP GiveWP allows Exploiting Incorrectly Configured Access Control Security Levels.33.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.15.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.14.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest'. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.12.0. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.25.1. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.4.2. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.3.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform allows Stored XSS.2.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform.25.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform.25.1. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable. No vendor patch available.
A vulnerability in StellarWP GiveWP give.25.1. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP - Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The GiveWP - Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The give plugin before 2.4.7 for WordPress has XSS via a donor name. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.