Unknown Givewp vulnerabilities

8 vulnerabilities

Known vulnerabilities in Unknown Givewp, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.4CVE-2022-4448givewpgivewp+2
EPSS score
0.56%
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks6.1CVE-2024-11921givewpgivewp+2
EPSS score
0.79%
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.7.5CVE-2026-14319unknowngivewp+1
EPSS score
0.43%
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.6.8CVE-2026-14318unknowngivewp+1
EPSS score
0.43%
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.5.3CVE-2026-14317unknowngivewp+1
EPSS score
0.30%
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.6.5CVE-2026-85113unknowngivewp+1
EPSS score
0.31%
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.8.1CVE-2026-85530unknowngivewp+1
EPSS score
0.38%
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.9.8CVE-2023-0224givewpgivewp+2
EPSS score
3.74%
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks