CVE-2024-5941

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2024-9130

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2024-5977

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2024-6551

GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2023-0224

GiveWP < 2.24.1 - Unauthenticated SQLi

The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2024-11921

Give < 3.19.0 - Reflected XSS

The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-4448

GiveWP < 2.24.0 - Contributor+ Stored XSS

The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2024-37099

WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Givewp Liquidweb

Products

Givewp Givewp

CVE-2023-23672

WordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-31475

WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-28700

WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Creation via Export function vulnerability

Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

CVSS 3.1 · 9.1 Critical EPSS 2.1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2023-23668

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2023-25450

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-2260

GiveWP < 2.21.3 - DoS via CSRF

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-2215

GiveWP < 2.21.3 - Admin+ Stored Cross-Site Scripting

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-0252

Give < 2.17.3 - Reflected Cross-Site Scripting via Import Tool

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2021-25100

Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2021-25099

Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting

The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting

CVSS 3.1 · 6.1 Medium EPSS 2.1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2021-24524

GiveWP < 2.12.0 - Authenticated Stored XSS

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2021-24315

Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp