# stellarwp GiveWP – Donation Plugin and Fundraising Platform.

Every CVE that names stellarwp GiveWP – Donation Plugin and Fundraising Platform among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter](https://agentprime.io/advisories/CVE-2026-118193.md)
  `CVE-2026-118193` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-97643.md)
  `CVE-2026-97643` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site scripting (XSS)
- [GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-5510.md)
  `CVE-2026-5510` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Cross-site scripting (XSS)
- [GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting](https://agentprime.io/advisories/CVE-2026-14987.md)
  `CVE-2026-14987` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Cross-site scripting (XSS)
- [GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form](https://agentprime.io/advisories/CVE-2026-13704.md)
  `CVE-2026-13704` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site scripting (XSS)
- [GiveWP <= 4.15.3 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-11981.md)
  `CVE-2026-11981` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 4.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-13246.md)
  `CVE-2026-13246` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS)
- [GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'](https://agentprime.io/advisories/CVE-2025-13206.md)
  `CVE-2025-13206` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 7.2 High · Not analysed yet · Published 19 Nov 2025 · Tags: Cross-site scripting (XSS)
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association](https://agentprime.io/advisories/CVE-2025-11228.md)
  `CVE-2025-11228` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2025 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure](https://agentprime.io/advisories/CVE-2025-11227.md)
  `CVE-2025-11227` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.5 Medium · Not analysed yet · Published 4 Oct 2025 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update](https://agentprime.io/advisories/CVE-2025-7221.md)
  `CVE-2025-7221` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2025 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure](https://agentprime.io/advisories/CVE-2025-8620.md)
  `CVE-2025-8620` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: Information disclosure
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2025-7205.md)
  `CVE-2025-7205` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Cross-site scripting (XSS)
- [GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification](https://agentprime.io/advisories/CVE-2025-4571.md)
  `CVE-2025-4571` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 19 Jun 2025 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-2331.md)
  `CVE-2025-2331` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2025 · Tags: Information disclosure
- [Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function](https://agentprime.io/advisories/CVE-2025-2025.md)
  `CVE-2025-2025` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.5 Medium · Not analysed yet · Published 15 Mar 2025 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2025-0912.md)
  `CVE-2025-0912` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2025 · Tags: Insecure deserialization
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2024-12877.md)
  `CVE-2024-12877` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jan 2025 · Tags: Insecure deserialization
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2024-9634.md)
  `CVE-2024-9634` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2024 · Tags: Insecure deserialization
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2024-8353.md)
  `CVE-2024-8353` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 28 Sept 2024 · Tags: Insecure deserialization
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter](https://agentprime.io/advisories/CVE-2024-9130.md)
  `CVE-2024-9130` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 7.2 High · Not analysed yet · Published 27 Sept 2024 · Tags: SQL injection
- [GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure](https://agentprime.io/advisories/CVE-2024-6551.md)
  `CVE-2024-6551` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2024 · Tags: Information disclosure
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update](https://agentprime.io/advisories/CVE-2024-5940.md)
  `CVE-2024-5940` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure](https://agentprime.io/advisories/CVE-2024-5939.md)
  `CVE-2024-5939` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2024-5932.md)
  `CVE-2024-5932` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.77 · Not analysed yet · Published 20 Aug 2024 · Tags: Insecure deserialization
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion](https://agentprime.io/advisories/CVE-2024-5941.md)
  `CVE-2024-5941` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions](https://agentprime.io/advisories/CVE-2024-5977.md)
  `CVE-2024-5977` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 19 Jul 2024 · Tags: Broken access control
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-3714.md)
  `CVE-2024-3714` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 18 May 2024 · Tags: Cross-site scripting (XSS)
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode](https://agentprime.io/advisories/CVE-2024-1957.md)
  `CVE-2024-1957` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 13 Apr 2024 · Tags: Cross-site scripting (XSS)
- [GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-1424.md)
  `CVE-2024-1424` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 6.4 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site scripting (XSS)
- [GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation](https://agentprime.io/advisories/CVE-2023-4247.md)
  `CVE-2023-4247` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site request forgery (CSRF)
- [GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation](https://agentprime.io/advisories/CVE-2023-4246.md)
  `CVE-2023-4246` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 4.3 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site request forgery (CSRF)
- [GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion](https://agentprime.io/advisories/CVE-2023-4248.md)
  `CVE-2023-4248` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.4 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site request forgery (CSRF)
- [GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure](https://agentprime.io/advisories/CVE-2022-2117.md)
  `CVE-2022-2117` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2022 · Tags: Information disclosure

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=stellarwp-givewp-donation-plugin-and-fundraising-platform>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/stellarwp-givewp-donation-plugin-and-fundraising-platform/>. Everything for agents: <https://agentprime.io/llms.txt>.