Advisories · Technology

stellarwp GiveWP – Donation Plugin and Fundraising Platform.

Every CVE that names stellarwp GiveWP – Donation Plugin and Fundraising Platform among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118193 CVE record

CVSS 8.8 High

GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Privilege escalation
Not analysed yet 5 Nov 2026
CVE-2026-97643 CVE record

CVSS 6.4 Medium

GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-5510 CVE record

CVSS 6.4 Medium

GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 28 Aug 2026
CVE-2026-14987 CVE record

CVSS 6.4 Medium

GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 16 Jul 2026
CVE-2026-13704 CVE record

CVSS 6.4 Medium

GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 2 Jul 2026
CVE-2026-11981 CVE record

CVSS 4.3 Medium

GiveWP <= 4.15.3 - Cross-Site Request Forgery
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site request forgery (CSRF)
Not analysed yet 1 Jul 2026
CVE-2026-13246 CVE record

CVSS 6.4 Medium

GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 1 Jul 2026
CVE-2025-13206 CVE record

CVSS 7.2 High

GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 19 Nov 2025
CVE-2025-11228 CVE record

CVSS 5.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 4 Oct 2025
CVE-2025-11227 CVE record

CVSS 6.5 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 4 Oct 2025
CVE-2025-7221 CVE record

CVSS 4.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 21 Aug 2025
CVE-2025-8620 CVE record

CVSS 5.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Information disclosure
Not analysed yet 6 Aug 2025
CVE-2025-7205 CVE record

CVSS 5.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 31 Jul 2025
CVE-2025-4571 CVE record

CVSS 5.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 19 Jun 2025
CVE-2025-2331 CVE record

CVSS 5.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Information disclosure
Not analysed yet 22 Mar 2025
CVE-2025-2025 CVE record

CVSS 6.5 Medium

Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 15 Mar 2025
CVE-2025-0912 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Insecure deserialization
Not analysed yet 4 Mar 2025
CVE-2024-12877 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Insecure deserialization
Not analysed yet 11 Jan 2025
CVE-2024-9634 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Insecure deserialization
Not analysed yet 16 Oct 2024
CVE-2024-8353 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Insecure deserialization
Not analysed yet 28 Sept 2024
CVE-2024-9130 CVE record

CVSS 7.2 High

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- SQL injection
Not analysed yet 27 Sept 2024
CVE-2024-6551 CVE record

CVSS 5.3 Medium

GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Information disclosure
Not analysed yet 29 Aug 2024
CVE-2024-5940 CVE record

CVSS 6.5 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 20 Aug 2024
CVE-2024-5939 CVE record

CVSS 5.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 20 Aug 2024
CVE-2024-5932 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Insecure deserialization
Not analysed yet 20 Aug 2024
CVE-2024-5941 CVE record

CVSS 5.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 20 Aug 2024
CVE-2024-5977 CVE record

CVSS 5.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Broken access control
Not analysed yet 19 Jul 2024
CVE-2024-3714 CVE record

CVSS 6.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 18 May 2024
CVE-2024-1957 CVE record

CVSS 6.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 13 Apr 2024
CVE-2024-1424 CVE record

CVSS 6.4 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
Not analysed yet 9 Apr 2024
CVE-2023-4247 CVE record

CVSS 5.4 Medium

GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jan 2024
CVE-2023-4246 CVE record

CVSS 4.3 Medium

GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jan 2024
CVE-2023-4248 CVE record

CVSS 5.4 Medium

GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site request forgery (CSRF)
Not analysed yet 11 Jan 2024
CVE-2022-2117 CVE record

CVSS 5.3 Medium

GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Information disclosure
Not analysed yet 18 Jul 2022