Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Givewp (7d46424b-3e99-5205-b0bb-c2180f15c912) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111978 |
vulnerable | 2026-11-03 10:16:11.505786 |
GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
Published: 2026-10-25T06:00:20.427Z
Updated: 2026-10-26T10:13:37.813Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111974 |
vulnerable | 2026-11-03 10:16:11.378294 |
GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
MEDIUM (5.3)
The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
Published: 2026-10-26T07:05:39.930Z
Updated: 2026-10-26T10:03:48.798Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111981 |
vulnerable | 2026-11-03 10:16:11.328311 |
GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
Published: 2026-10-25T06:00:20.949Z
Updated: 2026-10-26T10:13:37.251Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111980 |
vulnerable | 2026-11-03 10:16:11.175251 |
GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
Published: 2026-10-25T06:00:20.775Z
Updated: 2026-10-26T10:13:37.394Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111979 |
vulnerable | 2026-11-03 10:16:11.039803 |
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
Published: 2026-10-25T06:00:20.600Z
Updated: 2026-10-26T10:13:37.532Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111976 |
vulnerable | 2026-11-03 10:16:10.572722 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85530 |
vulnerable | 2026-10-13 12:28:54.004678 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-85113 |
vulnerable | 2026-10-13 12:28:53.905400 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14317 |
vulnerable | 2026-09-16 04:33:12.417172 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14318 |
vulnerable | 2026-09-16 04:33:11.887546 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14319 |
vulnerable | 2026-09-16 04:33:11.767613 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11921 |
vulnerable | 2026-06-08 06:23:50.670734 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0224 |
vulnerable | 2026-06-08 05:52:04.550379 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4448 |
vulnerable | 2026-06-08 05:51:59.500871 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.