| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Sep 22, 2026, 06:09:06 | Entries count: 123 | |||
|
Donation Forms WP by Givecloud
vulnerable
|
Sep 07, 2025, 03:09:01 |
Min -
Max 1.0.10
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-by-givecloud allows Stored XSS.This issue affects Donation Forms WP by Givecloud: from n/a through <= 1.0.9. | |
|
vulnerable
|
Oct 20, 2024, 12:10:34 |
Min -
Max 2.1.4
|
Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4. | |
|
Giveaways and Contests by PromoSimple
vulnerable
|
Jan 18, 2025, 08:01:41 |
Min -
Max 1.24
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Brodie Giveaways and Contests by PromoSimple giveaways-contests-by-promosimple allows Stored XSS.This issue affects Giveaways and Contests by PromoSimple: from n/a through <= 1.24. | |
|
vulnerable
|
Feb 22, 2025, 23:02:19 |
Min -
Max 1.3.2
|
The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |
|
vulnerable
|
Sep 30, 2024, 16:09:45 |
Min -
Max 1.3.2
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through <= 1.3. | |
|
vulnerable
|
Dec 06, 2024, 06:12:42 |
Min -
Max 2.7.0
|
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'swin-campaign' shortcode in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whene... | |
|
vulnerable
|
Feb 21, 2025, 00:02:26 |
Min -
Max 2.9.0
|
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the apmswn_create_discount() function in all versions up to, and including, 2.8.0. This makes it possible for unauthenticated attackers to create coupons. | |
|
vulnerable
|
Jan 05, 2025, 09:01:11 |
Min -
Max 2.8.0
|
The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
Give – Divi Donation Modules
vulnerable
|
Feb 21, 2025, 12:02:25 |
Min -
Max 2.0.1
|
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-for-divi allows Retrieve Embedded Sensitive Data.This issue affects Give – Divi Donation Modules: from n/a through <= 2.0.0. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 16, 2026, 08:06:14 |
Min -
Max 2.42.1
|
Simple Giveaways – Grow your business, email lists and traffic with contests [giveasap] < 2.42.1 WordPress Simple Giveaways plugin <= 2.42.0 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered in WordPress Simple Giveaways plugin (versions <= 2.42.0). | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 16, 2026, 08:06:14 |
Min -
Max 2.42.1
|
Simple Giveaways – Grow your business, email lists and traffic with contests [giveasap] < 2.42.1 WordPress Simple Giveaways plugin <= 2.42.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Simple Giveaways plugin (versions <= 2.42.0). | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 16, 2026, 08:06:14 |
Min -
Max 2.18.0
|
Simple Giveaways – Grow your business, email lists and traffic with contests [giveasap] < 2.18.0 Freemius Library < 2.2.4 - Subscriber+ Arbitrary Option Update The library, used in numerous plugins, does not have proper authorisation when updating blog options, allowing any authenticated users, such as subscriber to update arbitrary options | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 16, 2026, 08:06:14 |
Min -
Max 2.18.0
|
Simple Giveaways – Grow your business, email lists and traffic with contests [giveasap] < 2.18.0 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update The Freemius SDK for WordPress is vulnerable to authorization bypass due to a missing capability check on the _get_db_option and _set_db_option functions in versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change site settings and potentially... | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 16, 2026, 08:06:14 |
Min -
Max 2.42.1
|
Simple Giveaways – Grow your business, email lists and traffic with contests [giveasap] < 2.42.1 Freemius SDK <= 2.4.2 - Missing Authorization Checks The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme runn... | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Apr 02, 2025, 19:04:36 |
Min -
Max 2.48.2
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways giveasap allows SQL Injection.This issue affects Simple Giveaways: from n/a through <= 2.48.1. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 10, 2024, 12:06:27 |
Min -
Max 2.46.1
|
Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
May 09, 2025, 10:05:41 |
Min -
Max 2.49.0
|
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways giveasap allows Cross Site Request Forgery.This issue affects Simple Giveaways: from n/a through <= 2.49.0. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Nov 15, 2024, 13:11:15 |
Min -
Max 2.42.1
|
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 07, 2024, 08:06:35 |
Min -
Max 2.36.2
|
The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 07, 2024, 08:06:35 |
Min -
Max 2.45.1
|
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 07, 2024, 08:06:35 |
Min -
Max 2.45.1
|
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 07, 2024, 08:06:35 |
Min -
Max 2.46.1
|
Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions. | |
|
Simple Giveaways – Grow your business, email lists and traffic with contests
vulnerable
|
Jun 07, 2024, 08:06:35 |
Min -
Max 2.45.1
|
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 21, 2024, 00:08:25 |
Min -
Max 3.14.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.24.1
|
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.0
|
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.3
|
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 21, 2024, 00:08:25 |
Min -
Max 3.14.2
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.24
|
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.25.2
|
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.25.2
|
Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.25.2
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from n/a through 2.25.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.25.2
|
Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.25.2
|
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.3
|
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.33.4
|
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.26.0
|
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 19, 2026, 13:08:33 |
Min -
Max 4.16.6
|
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.33.4
|
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.4.0
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.3.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.33.1
|
Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 19, 2026, 13:08:33 |
Min -
Max 4.16.6
|
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.33.4
|
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.6.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.5.0
|
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.11.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.7.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 10, 2024, 12:06:26 |
Min -
Max 2.33.2
|
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 0.8.5
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 0.8.5 WordPress Give Plugin <= 0.8.4 - Cross Site Scripting (XSS) Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 3.3.0
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 0.8.5
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 0.8.5 GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 0.8.5 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Sep 18, 2026, 12:09:16 |
Min -
Max 4.16.8.1
|
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.10.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.10.2 WordPress GiveWP plugin <= 2.10.1 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered by m0ze (Patchstack Red Team) in WordPress GiveWP plugin (versions <= 2.10.1). | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Mar 16, 2025, 08:03:54 |
Min -
Max 3.22.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.5.5
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.5.5 WordPress GiveWp plugin <= 2.5.4 - Authentication Bypass The weakness allows unauthenticated users to bypass API authentication methods and potentially access personally identifiable user information (PII) like names, addresses, IP addresses, and email addresses. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.21.0
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.21.0 WordPress GiveWP plugin <= 2.20.2 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress GiveWP plugin (versions <= 2.20.2). Update the WordPress GiveWP plugin to the latest available version (at least 2.21.0). | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.10.0
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.10.0 WordPress GiveWP plugin <= 2.9.7 - Reflected Cross-Site Scripting (XSS) vulnerability Reflected Cross-Site Scripting (XSS) vulnerability discovered by Austin Bentley in WordPress GiveWP plugin (versions <= 2.9.7). | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
May 01, 2026, 04:05:58 |
Min -
Max 4.14.6
|
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.5.1
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.5.1 WordPress Give plugin <= 2.5.0 - SQL Injection (SQLi) vulnerability SQL Injection (SQLi) vulnerability found by Tin Duong (Fortinet FortiGuard Labs) in WordPress Give plugin (version <= 2.5.0). | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 28, 2025, 03:06:37 |
Min -
Max 4.3.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 31, 2026, 05:07:35 |
Min -
Max 4.16.4
|
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 07, 2026, 05:08:34 |
Min -
Max 4.16.5.1
|
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
May 02, 2026, 02:05:25 |
Min -
Max 4.14.3
|
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 29, 2024, 15:08:44 |
Min -
Max 3.16.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Mar 23, 2025, 09:03:33 |
Min -
Max 3.22.2
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.24
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.24 GiveWP <= 2.23.2 - Unauthenticated SQL Injection The GiveWP plugin for WordPress is vulnerable to SQL Injection versions up to, and including, 2.23.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 10, 2024, 12:06:28 |
Min -
Max 2.25.2
|
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Unauthenticated CSV Injection The GiveWP plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.25.1 via the 'print_csv_rows' function used in exporting CSV files. This allows attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'process_bulk_action' AJAX function. This makes it possible for unauthenticated attackers to perform various bulk actions including deleting content via forged request granted they can trick a site admi... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Cross-Site Request Forgery via save The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'save' AJAX function. This makes it possible for unauthenticated attackers to import donations via forged request granted a CSV file containing those donations has been uploaded and they can trick a site administrator... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form_grid' shortcode in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permis... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 09, 2024, 19:06:15 |
Min -
Max 3.12.1
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.12.0. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'give_cache_flush' AJAX function. This makes it possible for unauthenticated attackers to flush the GiveWP cache via forged request granted they can trick a site administrator into performing... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'render_dropdown' AJAX function. This makes it possible for unauthenticated attackers to execute JavaScript in the browser of an administrator via forged request granted a CSV file c... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.2
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.2 GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler The GiveWP plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.25.1 via the 'give_get_content_by_ajax_handler'. This can allow authenticated attackers with administrator-level privileges to make web requests to arbitrary locations originating from the web application and can be ... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 29, 2025, 13:08:22 |
Min -
Max 4.6.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 06, 2025, 19:08:17 |
Min -
Max 4.6.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Sep 28, 2024, 18:09:22 |
Min -
Max 3.16.2
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932,... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.3
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_donation_import_callback function. This makes it possible for unauthenticated attackers to process the import of donations via a forged request granted they can trick a site administrator into performing an action ... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.3
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.3 WordPress GiveWP Plugin <= 2.25.2 is vulnerable to Cross Site Request Forgery (CSRF) Update the WordPress GiveWP plugin to the latest available version (at least 2.25.3). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress GiveWP Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.3
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.3 GiveWP < 2.25.3 - Cross-Site Request Forgery The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.21.0
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.21.0 Give < 2.21.0 - Reflected Cross-Site Scripting The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.3
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_ajax_store_payment_note function. This makes it possible for unauthenticated attackers to add donation notes via a forged request granted they can trick a site administrator into pe... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 17, 2026, 04:07:17 |
Min -
Max 4.16.4
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically whe... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 0.8.5
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 0.8.5 Give - Cross-Site Scripting (XSS) The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.25.3
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.25.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_ajax_delete_payment_note function. This makes it possible for unauthenticated attackers to add donation notes via a forged request granted they can trick a site administrator into ... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
May 21, 2026, 22:05:42 |
Min -
Max 4.14.6
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP allows DOM-Based XSS. This issue affects GiveWP: from n/a through 4.14.5. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 29, 2026, 16:08:13 |
Min -
Max 4.14.5
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-le... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 16, 2026, 07:06:58 |
Min -
Max 2.33.1
|
GiveWP – Donation Plugin and Fundraising Platform [give] < 2.33.1 Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation The Give - Donation Plugin plugin for WordPress is vulnerable to privilege escalation due to an insufficient capability check when updating default roles in versions up to, and including, 2.33.0. This makes it possible for authenticated attackers with Give Manager privileges to elevate their privileges to those of an administrator by setting the def... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 02, 2025, 18:08:56 |
Min -
Max 4.6.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiti... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 02, 2026, 16:07:55 |
Min -
Max 4.15.4
|
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 02, 2026, 16:07:55 |
Min -
Max 4.16.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Dec 10, 2025, 13:12:07 |
Min -
Max 4.13.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Sep 27, 2024, 18:09:50 |
Min -
Max 3.16.2
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be u... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Dec 29, 2024, 13:12:05 |
Min -
Max 3.19.0
|
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jan 12, 2025, 02:01:05 |
Min -
Max 3.19.4
|
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Sep 27, 2024, 18:09:50 |
Min -
Max 3.16.0
|
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jan 12, 2025, 02:01:05 |
Min -
Max 3.19.3
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a f... | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Oct 11, 2025, 05:10:37 |
Min -
Max 4.10.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 29, 2026, 12:07:44 |
Min -
Max 4.16.4
|
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Oct 11, 2025, 05:10:37 |
Min -
Max 4.10.1
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Oct 16, 2024, 15:10:27 |
Min -
Max 3.16.4
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 15, 2026, 19:08:46 |
Min -
Max 4.16.6
|
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Mar 04, 2025, 17:03:45 |
Min -
Max 3.20.0
|
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jul 19, 2024, 15:07:58 |
Min -
Max 3.14.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 15, 2026, 19:08:46 |
Min -
Max 4.16.6
|
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.5.10
|
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.5.5
|
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.5.1
|
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.10.4
|
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.17.3
|
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.17.3
|
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.17.3
|
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.3
|
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 21, 2024, 00:08:25 |
Min -
Max 3.14.2
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.3.1
|
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.4.7
|
The give plugin before 2.4.7 for WordPress has XSS via a donor name. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 14, 2026, 01:06:37 |
Min -
Max 4.13.2
|
Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.10.0
|
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Aug 21, 2024, 00:08:25 |
Min -
Max 3.14.0
|
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.0
|
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 14, 2026, 01:06:37 |
Min -
Max 4.13.2
|
Improper Control of Generation of Code ('Code Injection') vulnerability in StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through <= 4.13.1. | |
|
GiveWP – Donation Plugin and Fundraising Platform
vulnerable
|
Jun 07, 2024, 08:06:36 |
Min -
Max 2.21.3
|
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. | |