Advisories · Technology
GiveWP.
Every CVE that names GiveWP among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
- GiveWP
- CWE-20
- CVSS 2.7 Low
GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses
- GiveWP
- Broken access control
- CVSS 5.5 Medium
GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
- GiveWP
- Broken access control
- CVSS 6.8 Medium
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
- GiveWP
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
- GiveWP
- Path traversal
- CVSS 5.3 Medium
GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route
- GiveWP
- Information disclosure
- CVSS 6.5 Medium
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
- GiveWP
- Other injection
- CVSS 8.1 High
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
- GiveWP
- Privilege escalation
- CVSS 7.5 High
GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
- GiveWP
- Information disclosure
- CVSS 5.3 Medium
GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
- GiveWP
- Broken access control
- CVSS 6.8 Medium
GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
- GiveWP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Give < 3.19.0 - Reflected XSS
- GiveWP
- CVSS 8.8 High
WordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability
- GiveWP
- Privilege escalation
- CVSS 5.9 Medium
WordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerability
- GiveWP
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
GiveWP < 2.24.1 - Unauthenticated SQLi
- GiveWP
- CVSS 4.7 Medium
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection
- GiveWP
- Other injection
- CVSS 6.5 Medium
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
- GiveWP
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
GiveWP < 2.24.0 - Contributor+ Stored XSS
- GiveWP