StellarWP GiveWP – Donation Plugin and Fundraising Platform

• CVE-2026-118193 High 8.8 GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter 0.4%
• CVE-2026-97643 Medium 6.4 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes 0.2%
• CVE-2026-5510 Medium 6.4 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.4%
• CVE-2026-14987 Medium 6.4 GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting 0.4%
• CVE-2026-13704 Medium 6.4 GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form 0.4%
• CVE-2026-11981 Medium 4.3 GiveWP <= 4.15.3 - Cross-Site Request Forgery 0.2%
• CVE-2026-13246 Medium 6.4 GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute 0.4%
• CVE-2025-13206 High 7.2 GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' 0.4%
• CVE-2025-11228 Medium 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association 0.3%
• CVE-2025-11227 Medium 6.5 GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure 0.3%
• CVE-2025-7221 Medium 4.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update 0.3%
• CVE-2025-8620 Medium 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure 0.6%
• CVE-2025-7205 Medium 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting 0.2%
• CVE-2025-4571 Medium 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification 0.3%
• CVE-2025-2331 Medium 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure 0.4%
• CVE-2025-2025 Medium 6.5 Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function 0.6%
• CVE-2025-0912 Critical 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection 1.4%
• CVE-2024-12877 Critical 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection 1.2%
• CVE-2024-9634 Critical 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution 1.4%
• CVE-2024-8353 Critical 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection 32.4%
• CVE-2024-9130 High 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter 0.7%
• CVE-2024-6551 Medium 5.3 GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure 0.3%
• CVE-2024-5940 Medium 6.5 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update 0.5%
• CVE-2024-5939 Medium 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure 0.5%
• CVE-2024-5932 Critical 10.0 GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution 76.8%
• CVE-2024-5941 Medium 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion 0.4%
• CVE-2024-5977 Medium 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions 0.4%
• CVE-2024-3714 Medium 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2024-1957 Medium 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2024-1424 Medium 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
• CVE-2023-4247 Medium 5.4 GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation 0.3%
• CVE-2023-4246 Medium 4.3 GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation 0.3%
• CVE-2023-4248 Medium 5.4 GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion 0.3%
• CVE-2022-2117 Medium 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure 1.2%