CVE-2025-13206 | High | 7.2 | 2025-11-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all version… |
CVE-2025-11228 | Medium | 5.3 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-11227 | Medium | 6.5 | 2025-10-04 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 v… |
CVE-2025-7221 | Medium | 4.3 | 2025-08-21 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-8620 | Medium | 5.3 | 2025-08-06 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. T… |
CVE-2025-7205 | Medium | 5.4 | 2025-07-31 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all ve… |
CVE-2025-4571 | Medium | 5.4 | 2025-06-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient c… |
CVE-2025-2331 | Medium | 5.3 | 2025-03-22 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-2025 | Medium | 6.5 | 2025-03-15 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2025-0912 | Critical | 9.8 | 2025-03-04 | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted i… |
CVE-2025-22777 | Critical | 9.8 | 2025-01-13 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. |
CVE-2024-12877 | Critical | 9.8 | 2025-01-11 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 v… |
CVE-2023-23672 | Medium | 5.4 | 2025-01-02 | Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2023-47183 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP… |
CVE-2024-11921 | Medium | 4.8 | 2024-12-27 | The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-9634 | Critical | 9.8 | 2024-10-16 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 v… |
CVE-2024-8353 | Critical | 9.8 | 2024-09-28 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 v… |
CVE-2024-9130 | High | 7.2 | 2024-09-27 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions… |
CVE-2024-47315 | Medium | 5.4 | 2024-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1. |
CVE-2024-6551 | Medium | 5.3 | 2024-08-29 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1… |
CVE-2024-5941 | Medium | 5.4 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capabilit… |
CVE-2024-5940 | Medium | 6.5 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-5939 | Medium | 5.3 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on th… |
CVE-2024-5932 | Critical | 10.0 | 2024-08-20 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 v… |
CVE-2024-37099 | Critical | 10.0 | 2024-08-19 | Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1. |
CVE-2024-5977 | Medium | 5.4 | 2024-07-19 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi… |
CVE-2024-35679 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2024-3714 | Medium | 6.4 | 2024-05-18 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode… |
CVE-2023-41665 | High | 8.8 | 2024-05-17 | Improper Privilege Management vulnerability in GiveWP allows Privilege Escalation.This issue affects GiveWP: from n/a through 2.33.0. |
CVE-2024-1957 | Medium | 6.4 | 2024-04-13 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode… |
CVE-2022-40211 | Medium | 5.9 | 2024-04-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from… |
CVE-2024-1424 | Medium | 6.4 | 2024-04-09 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ve… |
CVE-2024-30229 | High | 8.0 | 2024-03-28 | Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.4.2. |
CVE-2024-27987 | High | 7.1 | 2024-03-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a… |
CVE-2023-51415 | Medium | 6.5 | 2024-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform… |
CVE-2023-0224 | Critical | 9.8 | 2024-01-16 | The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform… |
CVE-2023-4248 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4247 | Medium | 5.4 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-4246 | Medium | 4.3 | 2024-01-11 | The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce… |
CVE-2023-32513 | High | 7.5 | 2023-12-28 | Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fun… |
CVE-2022-40312 | Medium | 5.5 | 2023-12-18 | Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fu… |
CVE-2023-22719 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2023-25450 | Medium | 5.4 | 2023-06-15 | Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. |
CVE-2023-23668 | Medium | 6.5 | 2023-05-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. |
CVE-2022-4448 | Medium | 5.4 | 2023-02-13 | The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2022-2260 | Medium | 6.5 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which… |
CVE-2022-2215 | Medium | 4.8 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to… |
CVE-2022-31475 | Medium | 5.5 | 2022-07-21 | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-28700 | Critical | 9.1 | 2022-07-21 | Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-2117 | Medium | 5.3 | 2022-07-18 | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoin… |
CVE-2022-0252 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading t… |
CVE-2021-25100 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to… |
CVE-2021-25099 | Medium | 6.1 | 2022-02-21 | The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated re… |
CVE-2021-24524 | Medium | 4.8 | 2021-08-23 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing… |
CVE-2021-24315 | Medium | 4.8 | 2021-05-17 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checko… |
CVE-2021-24213 | Medium | 6.1 | 2021-04-12 | The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of t… |
CVE-2020-20627 | Medium | 5.3 | 2020-08-31 | The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. |
CVE-2019-20360 | High | 7.5 | 2020-01-08 | A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user inf… |
CVE-2019-15317 | Medium | 5.4 | 2019-08-22 | The give plugin before 2.4.7 for WordPress has XSS via a donor name. |
CVE-2019-13578 | Critical | 9.8 | 2019-08-15 | A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a… |
CVE-2019-9909 | Medium | 6.1 | 2019-03-22 | The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS. |