GiveWP – Donation Plugin and Fundraising Platform

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   GiveWP – Donation Plugin and Fundraising Platform

Information

Software Type Plugin
Software Slug give (view on wordpress.org)
Software Status Active
Software Author webdevmattcrom
Software Website givewp.com
Software Downloads 7,117,416
Software Active Installs 100,000
Software Record Last Updated May 1, 2024

Showing 1-20 of 40 Vulnerabilities

GiveWP <= 2.23.2 - Unauthenticated SQL Injection
9.8
CVE-2023-0224
Jan 19, 2023
Researchers:
GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
9.8
CVE-2019-13578
Aug 12, 2019
Researcher: Tin Duong
GiveWP <= 2.25.1 - Unauthenticated CSV Injection
8.3
CVE-2023-22719
Mar 8, 2023
Researcher: Rafshanzani Suhada
GiveWP <= 2.5.4 - Authorization Bypass
7.5
CVE-2019-20360
Sep 26, 2019
Researchers: Chloe Chamberland, Matt Barry
Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation
7.2
CVE-2023-41665
Aug 31, 2023
Researcher: Rafie Muhammad
GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2023-32513
May 10, 2023
Researcher: Rafie Muhammad
GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2024-1957
Apr 12, 2024
Researcher: Ngô Thiên An (ancorn_)
GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-1424
Mar 19, 2024
Researcher: Bassem Essam
GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2023-51415
Jan 19, 2024
Researcher: LVT-tholv2k
GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2022-40211
Mar 10, 2023
Researcher: Rafie Muhammad
GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode
6.4
CVE-2023-23668
Mar 8, 2023
Researcher: Rafshanzani Suhada
GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2022-4448
Jan 19, 2023
Researcher: István Márton
GiveWP <= 3.3.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-27987
Mar 15, 2024
Researcher: Rafie Muhammad
GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown
6.1
CVE ID Unknown
Mar 8, 2023
Researchers:
GiveWP <= 2.17.2 - Reflected Cross-Site Scripting
6.1
CVE-2021-25100
Jan 18, 2022
Researcher: ZhongFu Su
GiveWP <= 2.17.2 - Reflected Cross-Site Scripting
6.1
CVE-2021-25099
Jan 18, 2022
Researcher: ZhongFu Su
GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting
6.1
CVE-2021-24213
Mar 23, 2021
Researcher: Austin Bentley
GiveWP <= 2.3.0 - Cross-Site Scripting
6.1
CVE-2019-9909
Feb 5, 2019
Researcher: Tim Coen
GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Apr 20, 2015
Researchers:
GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation
5.5
CVE-2022-28700
Jul 12, 2022
Researcher: Rafie Muhammad
Title CVE ID CVSS Researchers Date
GiveWP <= 2.23.2 - Unauthenticated SQL Injection CVE-2023-0224 9.8 January 19, 2023
GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection CVE-2019-13578 9.8 Tin Duong August 12, 2019
GiveWP <= 2.25.1 - Unauthenticated CSV Injection CVE-2023-22719 8.3 Rafshanzani Suhada March 8, 2023
GiveWP <= 2.5.4 - Authorization Bypass CVE-2019-20360 7.5 Chloe Chamberland, Matt Barry September 26, 2019
Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation CVE-2023-41665 7.2 Rafie Muhammad August 31, 2023
GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection CVE-2023-32513 6.6 Rafie Muhammad May 10, 2023
GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-1957 6.4 Ngô Thiên An (ancorn_) April 12, 2024
GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1424 6.4 Bassem Essam March 19, 2024
GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-51415 6.4 LVT-tholv2k January 19, 2024
GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2022-40211 6.4 Rafie Muhammad March 10, 2023
GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode CVE-2023-23668 6.4 Rafshanzani Suhada March 8, 2023
GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2022-4448 6.4 István Márton January 19, 2023
GiveWP <= 3.3.1 - Reflected Cross-Site Scripting CVE-2024-27987 6.1 Rafie Muhammad March 15, 2024
GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown 6.1 March 8, 2023
GiveWP <= 2.17.2 - Reflected Cross-Site Scripting CVE-2021-25100 6.1 ZhongFu Su January 18, 2022
GiveWP <= 2.17.2 - Reflected Cross-Site Scripting CVE-2021-25099 6.1 ZhongFu Su January 18, 2022
GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting CVE-2021-24213 6.1 Austin Bentley March 23, 2021
GiveWP <= 2.3.0 - Cross-Site Scripting CVE-2019-9909 6.1 Tim Coen February 5, 2019
GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting 6.1 April 20, 2015
GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation CVE-2022-28700 5.5 Rafie Muhammad July 12, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation