GD
Product
GiveWP – Donation Plugin and Fundraising Platform
33
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 2Medium 26Low 0
Watch
Add GiveWP – Donation Plugin and Fundraising Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0912 | 9.8 | Mar 4 | GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection Affected: through 3.19.4 |
| CVE-2024-12877 | 9.8 | Jan 11 | GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection Affected: through 3.19.2 |
| CVE-2024-9634 | 9.8 | Oct 16 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution Affected: through 3.16.3 |
| CVE-2024-8353 | 9.8 | Sep 28 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection Affected: through 3.16.1 |
| CVE-2024-5932 | 9.8 | Aug 20 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution Affected: through 3.14.1 |
| CVE-2025-2025 | 7.5 | Mar 15 | Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function Affected: through 3.22.0 |
| CVE-2024-9130 | 7.2 | Sep 27 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter Affected: through 3.16.1 |
| CVE-2025-11227 | 6.5 | Oct 4 | GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure Affected: through 4.10.0 |
| CVE-2025-2331 | 6.5 | Mar 22 | GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure Affected: through 3.22.1 |
| CVE-2026-97643 | 6.4 | Oct 10 | GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes Affected: through 4.17.0 |
| CVE-2026-5510 | 6.4 | Aug 28 | GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Affected: through 4.14.4 |
| CVE-2026-14987 | 6.4 | Jul 16 | GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting Affected: through 4.16.3 |
| CVE-2026-13704 | 6.4 | Jul 2 | GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form Affected: through 4.16.1 |
| CVE-2026-13246 | 6.4 | Jul 1 | GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute Affected: through 4.16.0 |
| CVE-2025-13206 | 6.1 | Nov 19 | GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' Affected: through 4.13.0 |
| CVE-2025-7205 | 5.4 | Jul 31 | GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting Affected: through 4.5.0 |
| CVE-2025-4571 | 5.4 | Jun 19 | GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification Affected: through 4.3.0 |
| CVE-2024-5941 | 5.4 | Aug 20 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion Affected: through 3.14.1 |
| CVE-2024-5977 | 5.4 | Jul 19 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions Affected: through 3.13.0 |
| CVE-2024-3714 | 5.4 | May 18 | GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.10.0 |
| CVE-2024-1957 | 5.4 | Apr 13 | GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 3.6.1 |
| CVE-2024-1424 | 5.4 | Apr 9 | GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 3.5.1 |
| CVE-2023-4247 | 5.4 | Jan 11 | GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation Affected: through 2.33.3 |
| CVE-2025-11228 | 5.3 | Oct 4 | GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association Affected: through 4.10.0 |
| CVE-2025-8620 | 5.3 | Aug 6 | GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure Affected: through 4.6.0 |
| CVE-2024-6551 | 5.3 | Aug 29 | GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure Affected: through 3.15.1 |
| CVE-2024-5940 | 5.3 | Aug 20 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update Affected: through 3.13.0 |
| CVE-2024-5939 | 5.3 | Aug 20 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure Affected: through 3.13.0 |
| CVE-2022-2117 | 5.3 | Jul 18 | GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure Affected: through 2.20.2 |
| CVE-2026-11981 | 4.3 | Jul 1 | GiveWP <= 4.15.3 - Cross-Site Request Forgery Affected: through 4.15.3 |
| CVE-2025-7221 | 4.3 | Aug 21 | GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update Affected: through 4.5.0 |
| CVE-2023-4246 | 4.3 | Jan 11 | GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation Affected: through 2.33.3 |
| CVE-2023-4248 | 4.3 | Jan 11 | GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion Affected: through 2.33.3 |
Showing 33