GiveWP - Donation Plugin and Fundraising Platform vulnerabilities

Known security issues in the GiveWP - Donation Plugin and Fundraising Platform WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: give
Latest version: 4.19.0
Active installs: 100,000+
Known vulnerabilities: 112
Data updated: 2026-10-17 05:32 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 4.18.0.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.18.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization CVE-2026-106600 · Source	Medium	5.3	< 4.18.0.1	2026-10-08

Fixed in version 4.18.0 (4)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.18.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation CVE-2026-104405 · Source	High	8.1	< 4.18.0	2026-10-05
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-104672 · Source	High	7.1	< 4.18.0	2026-10-05
GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-104404 · Source	Medium	6.5	< 4.18.0	2026-10-05
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes CVE-2026-97643 · Source	Medium	6.4	< 4.18.0	2026-10-08

Fixed in version 4.17.0 (4)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.17.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation CVE-2026-97196 · Source	Critical	9.1	< 4.17.0	2026-09-24
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting CVE-2026-96830 · Source	High	7.1	< 4.17.0	2026-09-24
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure CVE-2026-96834 · Source	Medium	6.5	< 4.17.0	2026-09-24
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference CVE-2026-97066 · Source	Medium	5.3	< 4.17.0	2026-09-24

Fixed in version 4.16.9 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.9
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1. CVE-2026-96333 · Source	High	7.5	< 4.16.9	2026-10-09
GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution CVE-2026-85113 · Source	Medium	6.5	< 4.16.9	2026-09-14

Fixed in version 4.16.8.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.8.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation CVE-2026-85530 · Source	Not rated	-	< 4.16.8.1	2026-09-16

Fixed in version 4.16.7.2 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.7.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.7.1 - Unauthenticated PHP Object Injection to Remote Code Execution CVE-2026-82222 · Source	Critical	10.0	< 4.16.7.2	2026-08-27

Fixed in version 4.16.6 (4)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.6
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization CVE-2026-73348 · Source	Medium	6.5	< 4.16.6	2026-08-14
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization CVE-2026-73352 · Source	Medium	6.5	< 4.16.6	2026-08-14
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting CVE-2026-73357 · Source	Medium	6.5	< 4.16.6	2026-08-12
GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization CVE-2026-73349 · Source	Medium	5.3	< 4.16.6	2026-08-12

Fixed in version 4.16.5.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.5.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting CVE-2026-66690 · Source	High	7.1	< 4.16.5.1	2026-07-30

Fixed in version 4.16.4 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting CVE-2026-65441 · Source	High	7.1	< 4.16.4	2026-07-27
GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting CVE-2026-14987 · Source	Medium	6.4	< 4.16.4	2026-07-15
WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65464 · Source	Not rated	-	< 4.16.4	0000-00-00

Fixed in version 4.16.3 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.3
Vulnerability	Severity	CVSS	Affected versions	Published
[en] The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, includ CVE-2026-14319 · Source	Not rated	-	< 4.16.3	2026-07-31
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass CVE-2026-14317 · Source	Not rated	-	< 4.16.3	2026-07-31
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting CVE-2026-14318 · Source	Not rated	-	< 4.16.3	2026-07-30

Fixed in version 4.16.2 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form CVE-2026-13704 · Source	Medium	6.4	< 4.16.2	2026-07-01

Fixed in version 4.16.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.16.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute CVE-2026-13246 · Source	Medium	6.4	< 4.16.1	2026-06-30

Fixed in version 4.15.4 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.15.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.15.3 - Cross-Site Request Forgery CVE-2026-11981 · Source	Medium	4.3	< 4.15.4	2026-06-30

Fixed in version 4.14.6 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.14.6
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting CVE-2026-42678 · Source	High	7.1	< 4.14.6	2026-05-16
GiveWP <= 4.14.5 - Missing Authorization CVE-2026-42642 · Source	Medium	5.3	< 4.14.6	2026-03-02

Fixed in version 4.14.5 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.14.5
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-5510 · Source	Medium	6.4	< 4.14.5	2026-08-14

Fixed in version 4.14.3 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.14.3
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting CVE-2026-34900 · Source	High	7.1	< 4.14.3	2026-04-21

Fixed in version 4.13.2 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.13.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-66533 · Source	Medium	6.5	< 4.13.2	2025-12-09
GiveWP <= 4.13.1 - Cross-Site Request Forgery CVE-2025-67467 · Source	Medium	5.4	< 4.13.2	2025-12-09

Fixed in version 4.13.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.13.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' CVE-2025-13206 · Source	Medium	6.1	< 4.13.1	2025-11-18

Fixed in version 4.10.1 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.10.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure CVE-2025-11227 · Source	Medium	6.5	< 4.10.1	2025-10-03
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association CVE-2025-11228 · Source	Medium	5.3	< 4.10.1	2025-10-03

Fixed in version 4.6.1 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.6.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure CVE-2025-8620 · Source	Medium	5.3	< 4.6.1	0000-00-00
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update CVE-2025-7221 · Source	Medium	4.3	< 4.6.1	0000-00-00
FiboSearch <= 1.32.1 - Missing Authorization CVE-2025-47444 · Source	Low	0.0	< 4.6.1	2025-08-12

Fixed in version 4.6.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.6.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting CVE-2025-7205 · Source	Medium	5.4	< 4.6.0	0000-00-00

Fixed in version 4.3.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 4.3.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification CVE-2025-4571 · Source	Medium	5.4	< 4.3.1	0000-00-00

Fixed in version 3.22.2 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.22.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure CVE-2025-2331 · Source	Medium	6.5	< 3.22.2	0000-00-00

Fixed in version 3.22.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.22.1
Vulnerability	Severity	CVSS	Affected versions	Published
Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function CVE-2025-2025 · Source	High	7.5	< 3.22.1	0000-00-00

Fixed in version 3.20.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.20.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection CVE-2025-0912 · Source	Critical	9.8	< 3.20.0	0000-00-00

Fixed in version 3.19.4 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.19.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection CVE-2025-22777 · Source	Critical	9.8	< 3.19.4	2025-01-10

Fixed in version 3.19.3 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.19.3
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection CVE-2024-12877 · Source	Critical	9.8	< 3.19.3	2025-01-10

Fixed in version 3.19.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.19.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin < 3.19.0 is vulnerable to Cross Site Scripting (XSS) CVE-2024-11921 · Source	Medium	4.8	< 3.19.0	2024-12-06

Fixed in version 3.16.4 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.16.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution CVE-2024-9634 · Source	Critical	9.8	< 3.16.4	2024-10-15

Fixed in version 3.16.2 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.16.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection CVE-2024-8353 · Source	Critical	9.8	< 3.16.2	2024-09-27
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter CVE-2024-9130 · Source	High	7.2	< 3.16.2	2024-09-26

Fixed in version 3.16.0 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.16.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.15.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-47315 · Source	Medium	5.4	< 3.16.0	2024-09-25
GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure CVE-2024-6551 · Source	Medium	5.3	< 3.16.0	2024-08-28

Fixed in version 3.14.2 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.14.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.14.1 is vulnerable to PHP Object Injection CVE-2024-5932 · Source	Critical	9.8	< 3.14.2	2024-08-19
WordPress GiveWP Plugin <= 3.14.1 is vulnerable to PHP Object Injection CVE-2024-37099 · Source	Critical	9.8	< 3.14.2	2024-08-09
WordPress GiveWP Plugin <= 3.14.1 is vulnerable to Arbitrary File Deletion CVE-2024-5941 · Source	Medium	5.4	< 3.14.2	2024-08-19

Fixed in version 3.14.0 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.14.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Insecure Direct Object References (IDOR) CVE-2024-5977 · Source	Medium	5.4	< 3.14.0	2024-07-18
WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Broken Access Control CVE-2024-5939 · Source	Medium	5.3	< 3.14.0	2024-08-19
WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Broken Access Control CVE-2024-5940 · Source	Medium	5.3	< 3.14.0	2024-08-19

Fixed in version 3.12.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS) CVE-2024-35679 · Source	High	7.1	< 3.12.1	2024-06-06

Fixed in version 3.11.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.11.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-3714 · Source	Medium	5.4	< 3.11.0	2024-05-17

Fixed in version 3.7.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.7.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1957 · Source	Medium	5.4	< 3.7.0	2024-04-12

Fixed in version 3.6.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.6.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1424 · Source	Medium	5.4	< 3.6.0	2024-03-19

Fixed in version 3.5.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.5.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.4.2 is vulnerable to PHP Object Injection CVE-2024-30229 · Source	High	8.0	< 3.5.0	2024-03-28

Fixed in version 3.4.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.4.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS) CVE-2024-27987 · Source	High	7.1	< 3.4.0	2024-03-15

Fixed in version 3.3.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 3.3.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS) CVE-2023-51415 · Source	Medium	6.5	< 3.3.0	2024-01-19

Fixed in version 2.33.4 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.33.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation CVE-2023-4247 · Source	Medium	5.4	< 2.33.4	2023-10-31
GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation CVE-2023-4246 · Source	Medium	4.3	< 2.33.4	2023-10-31
GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion CVE-2023-4248 · Source	Medium	4.3	< 2.33.4	2023-10-31

Fixed in version 2.33.2 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.33.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 2.33.1 is vulnerable to Broken Access Control CVE-2023-47183 · Source	Medium	5.3	< 2.33.2	2023-10-31

Fixed in version 2.33.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.33.1
Vulnerability	Severity	CVSS	Affected versions	Published
Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation CVE-2023-41665 · Source	High	8.8	< 2.33.1	2023-08-31

Fixed in version 2.26.0 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.26.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection CVE-2023-32513 · Source	High	7.5	< 2.26.0	2023-05-09

Fixed in version 2.25.3 (5)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.25.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP Plugin <= 2.25.2 is vulnerable to Cross Site Request Forgery (CSRF) No CVE assigned · Source	Not rated	-	< 2.25.3	2023-03-27
GiveWP <= 2.25.2 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.25.3	2023-03-23
GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note No CVE assigned · Source	Not rated	-	< 2.25.3	2023-03-23
GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note No CVE assigned · Source	Not rated	-	< 2.25.3	2023-03-23
GiveWP < 2.25.3 - Cross-Site Request Forgery No CVE assigned · Source	Not rated	-	< 2.25.3	-

Fixed in version 2.25.2 (9)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.25.2
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode CVE-2023-23668 · Source	Medium	6.5	< 2.25.2	2023-03-08
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS) CVE-2022-40211 · Source	Medium	5.9	< 2.25.2	2023-03-10
GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler CVE-2022-40312 · Source	Medium	5.5	< 2.25.2	2023-03-08
WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Arbitrary Content Deletion CVE-2023-23672 · Source	Medium	5.4	< 2.25.2	2023-03-10
GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush CVE-2023-25450 · Source	Medium	5.4	< 2.25.2	2023-03-08
GiveWP <= 2.25.1 - Unauthenticated CSV Injection CVE-2023-22719 · Source	Medium	4.7	< 2.25.2	2023-03-08
GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action No CVE assigned · Source	Not rated	-	< 2.25.2	2023-03-08
GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown No CVE assigned · Source	Not rated	-	< 2.25.2	2023-03-08
GiveWP <= 2.25.1 - Cross-Site Request Forgery via save No CVE assigned · Source	Not rated	-	< 2.25.2	2023-03-08

Fixed in version 2.24 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.24
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.23.2 - Unauthenticated SQL Injection CVE-2023-0224 · Source	Critical	9.8	< 2.24	2023-01-18
GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2022-4448 · Source	Medium	5.4	< 2.24	2023-01-19

Fixed in version 2.21.3 (4)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.21.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP plugin <= 2.21.2 - DoS via Cross-Site Request Forgery (CSRF) vulnerability CVE-2022-2260 · Source	Medium	6.5	< 2.21.3	2022-07-08
WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability CVE-2022-31475 · Source	Medium	5.5	< 2.21.3	2022-07-12
WordPress GiveWP plugin <= 2.21.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2022-2215 · Source	Medium	4.8	< 2.21.3	2022-07-11
WordPress GiveWP plugin <= 2.11.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24524 · Source	Medium	4.8	< 2.21.3	2021-07-26

Fixed in version 2.21.0 (4)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.21.0
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability CVE-2022-28700 · Source	Critical	9.1	< 2.21.0	2022-07-12
WordPress GiveWP plugin <= 2.20.2 - Donor Information Disclosure vulnerability CVE-2022-2117 · Source	Medium	5.3	< 2.21.0	2022-06-17
WordPress GiveWP plugin <= 2.20.2 - Reflected Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 2.21.0	2022-06-20
Give < 2.21.0 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.21.0	-

Fixed in version 2.17.3 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.17.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP plugin <= 2.17.2 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2022-0252 · Source	Medium	6.1	< 2.17.3	2022-01-18
WordPress GiveWP plugin <= 2.17.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability CVE-2021-25099 · Source	Medium	6.1	< 2.17.3	2022-01-18
WordPress GiveWP plugin <= 2.17.2 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2021-25100 · Source	Medium	6.1	< 2.17.3	2022-01-18

Fixed in version 2.10.4 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.10.4
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting CVE-2021-24315 · Source	Medium	4.8	< 2.10.4	2021-04-30

Fixed in version 2.10.2 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.10.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress GiveWP plugin <= 2.10.1 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 2.10.2	2021-04-21

Fixed in version 2.10.0 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.10.0
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting CVE-2021-24213 · Source	Medium	6.1	< 2.10.0	2021-03-23
WordPress GiveWP plugin <= 2.9.7 - Reflected Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 2.10.0	2021-03-23

Fixed in version 2.5.10 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.5.10
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.5.9 - Missing Authorization to Settings Update CVE-2020-20627 · Source	Medium	5.3	< 2.5.10	2019-10-30

Fixed in version 2.5.5 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.5.5
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.5.4 - Authorization Bypass CVE-2019-20360 · Source	High	7.5	< 2.5.5	2019-09-26
WordPress GiveWp plugin <= 2.5.4 - Authentication Bypass No CVE assigned · Source	Not rated	-	< 2.5.5	2019-09-26

Fixed in version 2.5.1 (2)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.5.1
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection CVE-2019-13578 · Source	Critical	9.8	< 2.5.1	2019-08-12
WordPress Give plugin <= 2.5.0 - SQL Injection (SQLi) vulnerability No CVE assigned · Source	Not rated	-	< 2.5.1	2019-08-12

Fixed in version 2.4.7 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.4.7
Vulnerability	Severity	CVSS	Affected versions	Published
GiveWP <= 2.4.6 - Cross-Site Scripting CVE-2019-15317 · Source	Medium	5.4	< 2.4.7	2019-05-15

Fixed in version 2.3.1 (1)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 2.3.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Give plugin <= 2.3.0 - Reflected Cross-Site Scripting (XSS) vulnerability CVE-2019-9909 · Source	Medium	6.1	< 2.3.1	2019-02-05

Fixed in version 0.8.5 (3)

GiveWP - Donation Plugin and Fundraising Platform: Fixed in version 0.8.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Give Plugin <= 0.8.4 - Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 0.8.5	2015-04-20
GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 0.8.5	2015-04-20
Give - Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 0.8.5	-

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.