GCVE - cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:givewp:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Givewp (`7d46424b-3e99-5205-b0bb-c2180f15c912`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-14317`	vulnerable	2026-09-16 04:33:12.417172	GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled. Published: 2026-07-31T06:00:05.746Z Updated: 2026-07-31T13:35:13.963Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/fa6f5470-b30d-4052-aacd-a0571d4678ac/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-14318`	vulnerable	2026-09-16 04:33:11.887546	GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor. Published: 2026-07-30T06:00:08.464Z Updated: 2026-07-30T14:29:11.348Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/2957014f-542d-43fc-ad65-de236446eeeb/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-14319`	vulnerable	2026-09-16 04:33:11.767613	GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details. Published: 2026-07-31T06:00:05.924Z Updated: 2026-07-31T19:34:02.938Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/f90c88a8-e5a5-4bcf-8fa1-59cdfef015a4/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-11921`	vulnerable	2026-06-08 06:23:50.670734	Give < 3.19.0 - Reflected XSS The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Published: 2024-12-27T06:00:15.578Z Updated: 2024-12-27T18:24:53.515Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5f196294-5ba9-45b6-a27c-ab1702cc001f/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0224`	vulnerable	2026-06-08 05:52:04.550379	GiveWP < 2.24.1 - Unauthenticated SQLi The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks Published: 2024-01-16T15:54:45.597Z Updated: 2025-06-13T16:07:48.744Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/d8da539d-0a1b-46ef-b48d-710c59cf68e1/ https://givewp.com/core-2-24-0-vulnerability-patched/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-4448`	vulnerable	2026-06-08 05:51:59.500871	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.