Extension WordPress
Vulnérabilités GiveWP – Donation Plugin and Fundraising Platform
Cette page rassemble les failles publiées pour GiveWP – Donation Plugin and Fundraising Platform, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de GiveWP – Donation Plugin and Fundraising Platform
77 fiches
GiveWP <= 4.16.3 – Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping.…
*-4.16.3
4.16.4
15/07/2026
GiveWP <= 4.16.1 – Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This…
*-4.16.1
4.16.2
01/07/2026
GiveWP <= 4.15.3 – Cross-Site Request Forgery
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable…
*-4.15.3
4.15.4
30/06/2026
GiveWP <= 4.16.0 – Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due…
*-4.16.0
4.16.1
30/06/2026
GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 – Unauthenticated Stored Cross-Site Scripting
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-4.14.5
4.14.6
16/05/2026
GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 – Reflected Cross-Site Scripting
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.14.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
*-4.14.2
4.14.3
21/04/2026
GiveWP <= 4.14.5 – Missing Authorization
The GiveWP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.14.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.
*-4.14.5
4.14.6
02/03/2026
GiveWP <= 4.13.1 – Unauthenticated Arbitrary Shortcode Execution
The The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.13.1. This is due to the software allowing users to execute an action…
*-4.13.1
4.13.2
08/01/2026
GiveWP <= 4.13.1 – Cross-Site Request Forgery
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on a function. This…
*-4.13.1
4.13.2
23/12/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.13.0 – Unauthenticated Stored Cross-Site Scripting via 'name'
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This…
*-4.13.0
4.13.1
18/11/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 – Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check.…
*-4.10.0
4.10.1
03/10/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 – Missing Authorization to Unauthenticated Forms-Campaign Association
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes…
*-4.10.0
4.10.1
03/10/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 – Missing Authorization to Donation Update
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes…
*-4.5.0
4.6.1
20/08/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 – Unauthenticated Donor Data Exposure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor…
*-4.6.0
4.6.1
05/08/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 – Authenticated (GiveWP worker+) Stored Cross-Site Scripting
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping.…
*-4.5.0
4.6.0
30/07/2025
GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 – Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0.…
*-4.3.0
4.3.1
18/06/2025
GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 – Authenticated (Subscriber+) Sensitive Information Exposure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible…
*-3.22.1
3.22.2
21/03/2025
Give <= 3.22.0 – Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes…
*-3.22.0
3.22.1
14/03/2025
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 – Unauthenticated PHP Object Injection
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for…
*-3.19.4
3.20.0
03/03/2025
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 – Unauthenticated PHP Object Injection
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes…
*-3.19.2
3.19.3
10/01/2025
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.