Givewp (Unknown) - vulnerabilities (CVEs)
14 CVEs, 6 in the last 30 days, 2 known versions, newest CVE from 2026-10-26. Vendor: Unknown.
CVEs of Givewp
- CVE-2026-111974 - CVSS 5.3 (medium), 2026-10-26: The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount…
- CVE-2026-111981 - CVSS 2.7 (low), 2026-10-25: The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted…
- CVE-2026-111976 - CVSS 5.3 (medium), 2026-10-25: The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route,…
- CVE-2026-111980 - CVSS 5.5 (medium), 2026-10-25: The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom…
- CVE-2026-111979 - CVSS 6.8 (medium), 2026-10-25: The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an…
- CVE-2026-111978 - CVSS 6 (medium), 2026-10-25: The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a…
- CVE-2026-85113 - CVSS 6.5 (medium), 2026-09-21: The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the…
- CVE-2026-85530 - CVSS 8.1 (high), 2026-09-16: The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses…
- CVE-2026-14319 - CVSS 7.5 (high), 2026-07-31: The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing…
- CVE-2026-14317 - CVSS 5.3 (medium), 2026-07-31: The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part…
- CVE-2026-14318 - CVSS 6.8 (medium), 2026-07-30: The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the…
- CVE-2024-11921 - CVSS 4.8 (medium), 2024-12-27: The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site…
- CVE-2023-0224 - CVSS 9.8 (critical), 2024-01-16: The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform…
- CVE-2022-4448 - CVSS 5.4 (medium), 2023-02-13: The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the…
