VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

GiveWP – Donation Plugin and Fundraising Platform security & vulnerabilities

give— active installsLast vulnerability Nov 4, 2026

No known unpatched vulnerabilities in the latest version

All 109 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
109Known vulnerabilities
  • Critical9
  • High15
  • Medium85
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152019: 5 vulnerabilities5192021: 3 vulnerabilities3212022: 8 vulnerabilities8222023: 20 vulnerabilities20232024: 19 vulnerabilities19242025: 13 vulnerabilities13252026: 40 vulnerabilities4026

All GiveWP – Donation Plugin and Fundraising Platform vulnerabilities

GiveWP – Donation Plugin and Fundraising Platform vulnerabilities
SeverityVulnerabilityCVEPublished
High8.8Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
≤4.19.1Update to 4.19.1.1
CVE-2026-118193
Medium5.3Missing Authorization
≤4.19.0.1Update to 4.19.0.2
CVE-2026-116853
Medium5.3Unauthenticated Information Exposure
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111976
Medium5.3Unauthenticated Donation Amount Restriction Bypass
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111974
Medium6.5Authenticated (Give Manager+) Path Traversal
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111978
Medium4.3Missing Authorization
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111980
Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111979
Medium4.3Missing Authorization
≤4.19.0.0Update to 4.19.0.1
CVE-2026-111981
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
≤4.17.0Update to 4.18.0
CVE-2026-97643
Medium5.3Missing Authorization
≤4.18.0Update to 4.18.0.1
CVE-2026-106600
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.17.0Update to 4.18.0
CVE-2026-104672
High7.3Unauthenticated Privilege Escalation
≤4.17.0Update to 4.18.0
CVE-2026-104405
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.17.0Update to 4.18.0
CVE-2026-104404
Medium5.3Unauthenticated Payment Bypass
≤4.16.8.1Update to 4.16.9
CVE-2026-96333
Medium4.3Authenticated (Subscriber+) Information Exposure
≤4.16.9Update to 4.17.0
CVE-2026-96834
Medium5.3Unauthenticated Insecure Direct Object Reference
≤4.16.9Update to 4.17.0
CVE-2026-97066
Medium5.3Unauthenticated User Impersonation
≤4.16.9Update to 4.17.0
CVE-2026-97196
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.9Update to 4.17.0
CVE-2026-96830
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤4.16.8Update to 4.16.9
CVE-2026-85113
High7.3Unauthenticated Privilege Escalation
≤4.16.8.0Update to 4.16.8.1
CVE-2026-85530
Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
≤4.16.7.1Update to 4.16.7.2
CVE-2026-82222
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤4.14.4Update to 4.14.5
CVE-2026-5510
Medium5.3Missing Authorization
≤4.16.5.1Update to 4.16.6
CVE-2026-73352
Medium5.3Missing Authorization
<4.16.6Update to 4.16.6
CVE-2026-73348
Medium6.4Authenticated (Donor+) Stored Cross-Site Scripting
<4.16.6Update to 4.16.6
CVE-2026-73357
Medium5.3Missing Authorization
<4.16.6Update to 4.16.6
CVE-2026-73349
Medium5.3Unauthenticated Payment Bypass
<4.16.3Update to 4.16.3
CVE-2026-14317
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.5Update to 4.16.5.1
CVE-2026-66690
Medium6.4Authenticated (Custom role+) Stored Cross-Site Scripting
<4.16.3Update to 4.16.3
CVE-2026-14318
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.3Update to 4.16.4
CVE-2026-65441
Medium4.3Cross-Site Request Forgery
≤4.16.3Update to 4.16.4
CVE-2026-65464
Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting
≤4.16.3Update to 4.16.4
CVE-2026-14987
Medium5.3Unauthenticated Recurring Donor Information Disclosure
≤4.16.2Update to 4.16.3
CVE-2026-14319
Medium6.4Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form
≤4.16.1Update to 4.16.2
CVE-2026-13704
Medium4.3Cross-Site Request Forgery
≤4.15.3Update to 4.15.4
CVE-2026-11981
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute
≤4.16.0Update to 4.16.1
CVE-2026-13246
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.14.5Update to 4.14.6
CVE-2026-42678
Medium6.1Reflected Cross-Site Scripting
≤4.14.2Update to 4.14.3
CVE-2026-34900
Medium5.3Missing Authorization
≤4.14.5Update to 4.14.6
CVE-2026-42642
Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤4.13.1Update to 4.13.2
CVE-2025-66533
Medium4.3Cross-Site Request Forgery
≤4.13.1Update to 4.13.2
CVE-2025-67467
High7.2Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
≤4.13.0Update to 4.13.1
CVE-2025-13206
Medium6.5Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
≤4.10.0Update to 4.10.1
CVE-2025-11227
Medium5.3Missing Authorization to Unauthenticated Forms-Campaign Association
≤4.10.0Update to 4.10.1
CVE-2025-11228
Medium4.3Missing Authorization to Donation Update
≤4.5.0Update to 4.6.1
CVE-2025-7221
Medium5.3Unauthenticated Donor Data Exposure
≤4.6.0Update to 4.6.1
CVE-2025-8620
Medium5.4Authenticated (GiveWP worker+) Stored Cross-Site Scripting
≤4.5.0Update to 4.6.0
CVE-2025-7205
Medium5.4Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
≤4.3.0Update to 4.3.1
CVE-2025-4571
Medium5.3Authenticated (Subscriber+) Sensitive Information Exposure
≤3.22.1Update to 3.22.2
CVE-2025-2331
Medium6.5Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
≤3.22.0Update to 3.22.1
CVE-2025-2025
Critical9.8Unauthenticated PHP Object Injection
≤3.19.4Update to 3.20.0
CVE-2025-0912
Critical9.8Unauthenticated PHP Object Injection
≤3.19.3Update to 3.19.4
CVE-2025-22777
Critical9.8Unauthenticated PHP Object Injection
≤3.19.2Update to 3.19.3
CVE-2024-12877
Medium6.1Reflected Cross-Site Scripting
≤3.18.0Update to 3.19.0
CVE-2024-11921
Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
≤3.16.3Update to 3.16.4
CVE-2024-9634
Critical9.8Unauthenticated PHP Object Injection
≤3.16.1Update to 3.16.2
CVE-2024-8353
High7.2Authenticated (GiveWP Manager+) SQL Injection via order Parameter
≤3.16.1Update to 3.16.2
CVE-2024-9130
Medium4.3Cross-Site Request Forgery
≤3.15.1Update to 3.16.0
CVE-2024-47315
Medium5.3Unauthenticated Full Path Disclosure
≤3.15.1Update to 3.16.0
CVE-2024-6551
Critical10.0Unauthenticated PHP Object Injection to Remote Code Execution
≤3.14.1Update to 3.14.2
CVE-2024-5932
Medium6.5Missing Authorization to Unauthenticated Event Settings Update
≤3.13.0Update to 3.14.0
CVE-2024-5940
Medium5.4Missing Authorization to Authenticated (Subscriber+) Limited File Deletion
≤3.14.1Update to 3.14.2
CVE-2024-5941
Medium5.3Missing Authorization to Limited Information Exposure
≤3.13.0Update to 3.14.0
CVE-2024-5939
High8.1Unauthenticated PHP Object Injection
≤3.14.1Update to 3.14.2
CVE-2024-37099
Medium5.4Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
≤3.13.0Update to 3.14.0
CVE-2024-5977
Medium6.1Reflected Cross-Site Scripting
≤3.12.0Update to 3.12.1
CVE-2024-35679
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.10.0Update to 3.11.0
CVE-2024-3714
High8.8Authenticated (GiveWP Manager+) PHP Object Injection
≤3.4.2Update to 3.5.0
CVE-2024-30229
Medium6.4GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.6.1Update to 3.7.0
CVE-2024-1957
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.5.1Update to 3.6.0
CVE-2024-1424
Medium6.1Reflected Cross-Site Scripting
≤3.3.1Update to 3.4.0
CVE-2024-27987
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.2Update to 3.3.0
CVE-2023-51415
Medium4.3Cross-Site Request Forgery to plugin installation
≤2.33.3Update to 2.33.4
CVE-2023-4246
Medium5.4Cross-Site Request Forgery to Stripe Integration Deletion
≤2.33.3Update to 2.33.4
CVE-2023-4248
Medium5.3Missing Authorization via handleBeforeGateway
≤2.33.1Update to 2.33.2
CVE-2023-47183
Medium5.4Cross-Site Request Forgery to plugin deactivation
≤2.33.3Update to 2.33.4
CVE-2023-4247
High7.2Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation
<2.33.1Update to 2.33.1
CVE-2023-41665
Medium6.6Authenticated (Admin+) PHP Object Injection
≤2.25.3Update to 2.26.0
CVE-2023-32513
Medium4.3Cross-Site Request Forgery
≤2.25.2Update to 2.25.3
—
Medium5.3Cross-Site Request Forgery via give_ajax_delete_payment_note
≤2.25.2Update to 2.25.3
—
Medium5.3Cross-Site Request Forgery via give_ajax_store_payment_note
≤2.25.2Update to 2.25.3
—
Medium5.4Authenticated (Contributor+) Arbitrary Content Deletion
≤2.25.1Update to 2.25.2
CVE-2023-23672
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤2.25.1Update to 2.25.2
CVE-2022-40211
Medium4.3Cross-Site Request Forgery via give_cache_flush
≤2.25.1Update to 2.25.2
CVE-2023-25450
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown
≤2.25.1Update to 2.25.2
—
High8.3Unauthenticated CSV Injection
≤2.25.1Update to 2.25.2
CVE-2023-22719
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode
≤2.25.1Update to 2.25.2
CVE-2023-23668
Medium5.4Cross-Site Request Forgery via process_bulk_action
≤2.25.1Update to 2.25.2
—
Medium4.3Cross-Site Request Forgery via save
≤2.25.1Update to 2.25.2
—
Medium4.1Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler
≤2.25.1Update to 2.25.2
CVE-2022-40312
Critical9.8Unauthenticated SQL Injection
≤2.23.2Update to 2.24
CVE-2023-0224
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.23.2Update to 2.24
CVE-2022-4448
Medium4.9Authenticated Arbitrary File Read
≤2.20.2Update to 2.21.0
CVE-2022-31475
Medium5.5Authenticated Arbitrary File Creation
≤2.20.2Update to 2.21.0
CVE-2022-28700
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
≤2.21.2Update to 2.21.3
CVE-2022-2215
Medium4.3Cross-Site Request Forgery
≤2.21.2Update to 2.21.3
CVE-2022-2260
Medium5.3Sensitive Information Disclosure
≤2.20.2Update to 2.21.0
CVE-2022-2117
Medium4.8Reflected Cross-Site Scripting via Import Tool
<2.17.3Update to 2.17.3
CVE-2022-0252
Medium6.1Reflected Cross-Site Scripting
<2.17.3Update to 2.17.3
CVE-2021-25100
Medium6.1Reflected Cross-Site Scripting
<2.17.3Update to 2.17.3
CVE-2021-25099
Medium4.8Authenticated Stored Cross-Site Scripting
<2.12.0Update to 2.12.0
CVE-2021-24524
Medium4.8Authenticated Stored Cross-Site Scripting
<2.10.4Update to 2.10.4
CVE-2021-24315
Medium6.12.9.7 - Reflected Cross Site Scripting
2.4.0 – <2.10.0Update to 2.10.0
CVE-2021-24213
Medium5.3Missing Authorization to Settings Update
<2.5.10Update to 2.5.10
CVE-2020-20627
High7.5Authorization Bypass
≤2.5.4Update to 2.5.5
CVE-2019-20360
Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
≤2.5.0Update to 2.5.1
CVE-2019-13578
Medium5.4Cross-Site Scripting
<2.4.7Update to 2.4.7
CVE-2019-15317
Medium6.1Cross-Site Scripting
<2.3.1Update to 2.3.1
CVE-2019-9909
Medium6.1Reflected Cross-Site Scripting
<0.8.5Update to 0.8.5
—

GiveWP – Donation Plugin and Fundraising Platform: common questions

Does GiveWP – Donation Plugin and Fundraising Platform have known vulnerabilities?

Yes. VulnCrest Radar lists 109 known vulnerabilities in GiveWP – Donation Plugin and Fundraising Platform: 9 critical, 15 high, 85 medium. None are known to affect version null.

How do I check which version of GiveWP – Donation Plugin and Fundraising Platform I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent GiveWP – Donation Plugin and Fundraising Platform vulnerability?

CVE-2026-118193, published Nov 4, 2026: GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter. Severity: High (CVSS 8.8).

Is any GiveWP – Donation Plugin and Fundraising Platform vulnerability listed in CISA KEV?

No. None of the known GiveWP – Donation Plugin and Fundraising Platform vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?