WordPress plugin
GiveWP – Donation Plugin and Fundraising Platform security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 109 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical9
- High15
- Medium85
- Low0
All GiveWP – Donation Plugin and Fundraising Platform vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter ≤4.19.1Update to 4.19.1.1 | CVE-2026-118193 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.17.0Update to 4.18.0 | CVE-2026-104672 | |
| High7.3 | Unauthenticated Privilege Escalation ≤4.17.0Update to 4.18.0 | CVE-2026-104405 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.16.9Update to 4.17.0 | CVE-2026-96830 | |
| High7.3 | Unauthenticated Privilege Escalation ≤4.16.8.0Update to 4.16.8.1 | CVE-2026-85530 | |
| Critical9.8 | Unauthenticated PHP Object Injection to Remote Code Execution ≤4.16.7.1Update to 4.16.7.2 | CVE-2026-82222 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.16.5Update to 4.16.5.1 | CVE-2026-66690 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.16.3Update to 4.16.4 | CVE-2026-65441 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.14.5Update to 4.14.6 | CVE-2026-42678 | |
| High7.2 | Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' ≤4.13.0Update to 4.13.1 | CVE-2025-13206 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤3.19.4Update to 3.20.0 | CVE-2025-0912 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤3.19.3Update to 3.19.4 | CVE-2025-22777 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤3.19.2Update to 3.19.3 | CVE-2024-12877 | |
| Critical9.8 | Unauthenticated PHP Object Injection to Remote Code Execution ≤3.16.3Update to 3.16.4 | CVE-2024-9634 | |
| Critical9.8 | Unauthenticated PHP Object Injection ≤3.16.1Update to 3.16.2 | CVE-2024-8353 | |
| High7.2 | Authenticated (GiveWP Manager+) SQL Injection via order Parameter ≤3.16.1Update to 3.16.2 | CVE-2024-9130 | |
| Critical10.0 | Unauthenticated PHP Object Injection to Remote Code Execution ≤3.14.1Update to 3.14.2 | CVE-2024-5932 | |
| High8.1 | Unauthenticated PHP Object Injection ≤3.14.1Update to 3.14.2 | CVE-2024-37099 | |
| High8.8 | Authenticated (GiveWP Manager+) PHP Object Injection ≤3.4.2Update to 3.5.0 | CVE-2024-30229 | |
| High7.2 | Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation <2.33.1Update to 2.33.1 | CVE-2023-41665 | |
| High8.3 | Unauthenticated CSV Injection ≤2.25.1Update to 2.25.2 | CVE-2023-22719 | |
| Critical9.8 | Unauthenticated SQL Injection ≤2.23.2Update to 2.24 | CVE-2023-0224 | |
| High7.5 | Authorization Bypass ≤2.5.4Update to 2.5.5 | CVE-2019-20360 | |
| Critical9.8 | Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection ≤2.5.0Update to 2.5.1 | CVE-2019-13578 |
- High8.8Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter
≤4.19.1Update to 4.19.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.17.0Update to 4.18.0
- High7.3Unauthenticated Privilege Escalation
≤4.17.0Update to 4.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.9Update to 4.17.0
- High7.3Unauthenticated Privilege Escalation
≤4.16.8.0Update to 4.16.8.1
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
≤4.16.7.1Update to 4.16.7.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.5Update to 4.16.5.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.16.3Update to 4.16.4
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.14.5Update to 4.14.6
- High7.2Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
≤4.13.0Update to 4.13.1
- Critical9.8Unauthenticated PHP Object Injection
≤3.19.4Update to 3.20.0
- Critical9.8Unauthenticated PHP Object Injection
≤3.19.3Update to 3.19.4
- Critical9.8Unauthenticated PHP Object Injection
≤3.19.2Update to 3.19.3
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution
≤3.16.3Update to 3.16.4
- Critical9.8Unauthenticated PHP Object Injection
≤3.16.1Update to 3.16.2
- High7.2Authenticated (GiveWP Manager+) SQL Injection via order Parameter
≤3.16.1Update to 3.16.2
- Critical10.0Unauthenticated PHP Object Injection to Remote Code Execution
≤3.14.1Update to 3.14.2
- High8.1Unauthenticated PHP Object Injection
≤3.14.1Update to 3.14.2
- High8.8Authenticated (GiveWP Manager+) PHP Object Injection
≤3.4.2Update to 3.5.0
- High7.2Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation
<2.33.1Update to 2.33.1
- High8.3Unauthenticated CSV Injection
≤2.25.1Update to 2.25.2
- Critical9.8Unauthenticated SQL Injection
≤2.23.2Update to 2.24
- High7.5Authorization Bypass
≤2.5.4Update to 2.5.5
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
≤2.5.0Update to 2.5.1
GiveWP – Donation Plugin and Fundraising Platform: common questions
Does GiveWP – Donation Plugin and Fundraising Platform have known vulnerabilities?
Yes. VulnCrest Radar lists 109 known vulnerabilities in GiveWP – Donation Plugin and Fundraising Platform: 9 critical, 15 high, 85 medium. None are known to affect version null.
How do I check which version of GiveWP – Donation Plugin and Fundraising Platform I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent GiveWP – Donation Plugin and Fundraising Platform vulnerability?
CVE-2026-118193, published Nov 4, 2026: GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter. Severity: High (CVSS 8.8).
Is any GiveWP – Donation Plugin and Fundraising Platform vulnerability listed in CISA KEV?
No. None of the known GiveWP – Donation Plugin and Fundraising Platform vulnerabilities is currently listed in the CISA KEV catalog.