Givewp – Donation Plugin And Fundraising Platform
Approved changes feed: RSS · Atom
cpe:2.3:a:givewp:givewp_–_donation_plugin_and_fundraising_platform:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Givewp (3094bdd5-a183-5f4d-9dcf-99d8707942e1) |
|---|---|
| Product | Givewp – Donation Plugin And Fundraising Platform (a3e02148-7495-59a2-bafc-13ec841977be) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-7205 |
vulnerable | 2026-06-08 07:43:18.146543 |
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
MEDIUM (5.4)
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
Published: 2025-07-31T07:25:00.594Z
Updated: 2026-04-08T16:46:50.644Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2025 |
vulnerable | 2026-06-08 07:14:57.786570 |
Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
MEDIUM (6.5)
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
Published: 2025-03-15T11:13:27.773Z
Updated: 2026-04-08T16:48:22.476Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-0912 |
vulnerable | 2026-06-08 07:02:25.896756 |
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
CRITICAL (9.8)
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Published: 2025-03-04T03:37:59.369Z
Updated: 2026-04-08T17:05:41.453Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51415 |
vulnerable | 2026-06-08 06:16:17.478399 |
WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)
MEDIUM (6.5)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2.
Published: 2024-02-10T08:39:12.408Z
Updated: 2026-04-28T16:09:01.932Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32513 |
vulnerable | 2026-06-08 06:04:46.447790 |
WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection
HIGH (7.5)
Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.
Published: 2023-12-28T10:46:26.559Z
Updated: 2026-04-28T16:08:23.149Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25450 |
vulnerable | 2026-06-08 05:56:08.817467 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40312 |
vulnerable | 2026-06-08 05:48:24.901133 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24315 |
vulnerable | 2026-06-08 05:30:04.168745 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24213 |
vulnerable | 2026-06-08 05:30:03.968927 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.