1 versión publicada superó todas las comprobaciones
Cada versión se limpia, se compara con el código de licencia del proveedor y se analiza antes de incorporarla al repositorio. Una versión que no supera las comprobaciones no se publica. Último análisis .
Retenidos: archivos de este plugin que no superaron las comprobaciones automáticas y no se publican. Hallazgos revisados: coincidencias de las reglas que se comprobaron y resolvieron antes de la publicación.
Cómo se comprueba cada versión
Análisis de malwareClamAV 1.5.4, base de datos de firmas 28169 (2026-10-30)
Cada archivo de cada versión, contra la base de datos de firmas de ClamAV.
Reglas de patronesYARA 4.5.2 · project.yar, php.yar · conjunto de reglas 5a07adb96f3b
Web shells, cargadores ofuscados, PHP codificado y patrones de nulling conocidos (php-malware-finder más reglas de MeteorGPL).
Análisis PHPHeurísticas v20
Análisis a nivel de tokens: inclusiones remotas, entradas de la petición que llegan a funciones de shell, decodificadores que alimentan eval, PHP oculto en imágenes, fuentes o archivos comprimidos, y sobrescrituras de manejadores del servidor.
Integridad de la licenciaConjunto de firmas 294436f328f6
El código de licencia, activación y actualización se compara con el código propio del proveedor y con la versión anterior; nunca se publica código de licencia alterado.
Sintaxis PHPPHP 8.3.36
Todos los archivos PHP se analizan sin errores de sintaxis en la versión de PHP que admite el repositorio.
Política de recursos80 imágenes reemplazadas · 9 archivos eliminados
Las ilustraciones, fuentes, archivos multimedia y contenido de demostración que puedan tener una licencia independiente se sustituyen por marcadores de posición o se eliminan (perfil de licencia gpl-full).
Notificar una vulnerabilidad. Los problemas de seguridad en el código propio del plugin corresponden al proveedor, GiveWP; notifícalos allí. Los problemas con un paquete tal como lo distribuye este repositorio — un archivo que no debería estar ahí, un análisis que pasó algo por alto — se envían a packages@meteorgpl.com y se responden en un plazo de 48 horas.
Qué ocurre cuando hay un hallazgo. Las versiones afectadas se retiran del repositorio, se avisa a quienes siguen el paquete y se publica una versión corregida cuando una supere todas las comprobaciones.
Informes públicos de vulnerabilidades de Give - Donation Plugin, las versiones afectadas y la versión de este repositorio que las corrige. Se avisa a quienes siguen el paquete y a las cuentas que sabemos que usan una versión afectada.
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.19.0.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.19.0.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.19.0.0. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with give worker-level access and above, to perform an unauthorized action.
Solución: Update to version 4.19.0.1, or a newer patched version
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 4.19.0.0. This is due to missing validation that restricts the submitted currency to the currencies accepted by the donation form, allowing amount limits to be compared as bare numbers across different currencies. This makes it possible for unauthenticated attackers to make donations below a form's configured minimum or fixed amount by supplying a currency not accepted by the form, bypassing amount limit checks that compare bare numbers.
Solución: Update to version 4.19.0.1, or a newer patched version
CWE-602: Client-Side Enforcement of Server-Side Security
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.19.0.0. This is due to a missing capability check on a function. This makes it possible for authenticated attackers to perform an unauthorized action.
Solución: Update to version 4.19.0.1, or a newer patched version
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.19.0.0. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Solución: Update to version 4.19.0.1, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 4.19.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.19.0.0. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with give manager-level access and above, to access files and directories outside of the intended directory.
Solución: Update to version 4.19.0.1, or a newer patched version
CWE-22: Improper Limitation of a Pathname to a Restricted Directory
El proveedor lo corrigió en 4.18.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.18.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.18.0.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.18.0. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.18.0.1, or a newer patched version
El proveedor lo corrigió en 4.18.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.17.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.18.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.18.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.17.0. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.
Solución: Update to version 4.18.0, or a newer patched version
El proveedor lo corrigió en 4.18.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.17.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.18.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.9; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 4.16.8.1. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.
Solución: Update to version 4.16.9, or a newer patched version
CWE-602: Client-Side Enforcement of Server-Side Security
El proveedor lo corrigió en 4.17.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.16.9. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.17.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.17.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to user impersonatyion in all versions up to, and including, 4.16.9. This makes it possible for unauthenticated attackers to spoof themselves as other users.
Solución: Update to version 4.17.0, or a newer patched version
El proveedor lo corrigió en 4.17.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.16.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user or configuration data.
Solución: Update to version 4.17.0, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 4.17.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.9. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.17.0, or a newer patched version
CWE-639: Authorization Bypass Through User-Controlled Key
El proveedor lo corrigió en 4.16.9; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 4.16.8. This is due to the use of do_shortcode() on user supplied input. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes registered on the site. The impact depends on which shortcodes the site has registered, so a site running a plugin whose shortcodes expose data or perform actions is affected more severely.
Solución: Update to version 4.16.9, or a newer patched version
El proveedor lo corrigió en 4.16.8.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.16.8.0. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.
Solución: Update to version 4.16.8.1, or a newer patched version
El proveedor lo corrigió en 4.16.7.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.16.7.1 via unsafe handling of serialized donor account data during the legacy donation process. An attacker without a pre-existing account can use GiveWP's registration handler to create a donor account, store a serialized object in the account's last_name profile field, and cause the donation flow to preserve that object in the GiveWP session. A subsequent request unserializes the session without restricting permitted classes. The plugin also contains a usable POP chain involving TCPDF and GiveWP's ProviderForwarder trait that permits arbitrary operating-system command execution. On versions 4.16.6 through 4.16.7.1, exploitation additionally requires a publicly obtainable registration nonce and a legacy or option-based donation form; earlier affected releases are reachable with a published donation form and an active payment gateway.
Solución: Update to version 4.16.7.2, or a newer patched version
El proveedor lo corrigió en 4.14.5; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.14.5, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 4.16.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.16.6, or a newer patched version
El proveedor lo corrigió en 4.16.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.16.5.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.16.6, or a newer patched version
El proveedor lo corrigió en 4.16.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 4.16.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.16.6, or a newer patched version
El proveedor lo corrigió en 4.16.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 4.16.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with donor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.6, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.3; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Payment Bypass in all versions up to 4.16.3 (exclusive). This makes it possible for unauthenticated attackers to bypass payments.
Solución: Update to version 4.16.3, or a newer patched version
El proveedor lo corrigió en 4.16.5.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.16.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.5.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.3; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom role-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.4, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.16.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 4.16.4, or a newer patched version
El proveedor lo corrigió en 4.16.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting in all versions up to, and including, 4.16.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with give worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes specifically when a donor clicks the Share on Twitter button on the Sequoia donation confirmation view, as that is when the unescaped twitter_message value is evaluated inside the JavaScript template literal.
Solución: Update to version 4.16.4, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.16.3; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.16.2. This is due to missing anonymity check in the subscription REST API endpoint allowing retrieval of anonymous donor subscription data without authentication. This makes it possible for unauthenticated attackers to retrieve donor information for anonymous recurring donors, exposing personally identifiable information that should be hidden.
Solución: Update to version 4.16.3, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 4.16.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.15.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 4.15.4, or a newer patched version
El proveedor lo corrigió en 4.16.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.16.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.14.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 4.14.6, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.14.3; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.14.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Solución: Update to version 4.14.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.14.6; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.14.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Solución: Update to version 4.14.6, or a newer patched version
El proveedor lo corrigió en 4.13.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.13.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Solución: Update to version 4.13.2, or a newer patched version
El proveedor lo corrigió en 4.13.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 4.13.2, or a newer patched version
El proveedor lo corrigió en 4.13.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability.
Solución: Update to version 4.13.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.10.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Solución: Update to version 4.10.1, or a newer patched version
El proveedor lo corrigió en 4.10.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.
Solución: Update to version 4.10.1, or a newer patched version
El proveedor lo corrigió en 4.6.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to update donations statuses. This ability is not present in the user interface.
Solución: Update to version 4.6.1, or a newer patched version
El proveedor lo corrigió en 4.6.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a duplicate of this issue. CVE-2025-47444 is a duplicate of this issue.
Solución: Update to version 4.6.1, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 4.6.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with GiveWP worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additionally, they need to trick an administrator into visiting the legacy version of the site.
Solución: Update to version 4.6.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 4.3.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to view or delete fundraising campaigns, view donors' data, modify campaign events, etc.
Solución: Update to version 4.3.1, or a newer patched version
El proveedor lo corrigió en 3.22.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
Solución: Update to version 3.22.2, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 3.22.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to disclose sensitive information included within earnings reports.
Solución: Update to version 3.22.1, or a newer patched version
El proveedor lo corrigió en 3.20.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donation Form through the 'card_address' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Solución: Update to version 3.20.0, or a newer patched version
El proveedor lo corrigió en 3.19.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.3 via deserialization of untrusted input from the donation form through the 'company' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this covers a bypass to the fix for CVE-2024-12877.
Solución: Update to version 3.19.4, or a newer patched version
El proveedor lo corrigió en 3.19.3; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server that makes remote code execution possible. Please note this was only partially patched in 3.19.3, a fully sufficient patch was not released until 3.19.4. However, another CVE was assigned by another CNA for version 3.19.3 so we will leave this as affecting 3.19.2 and before. We have recommended the vendor use JSON encoding to prevent any further deserialization vulnerabilities from being present.
Solución: Update to version 3.19.3, or a newer patched version
El proveedor lo corrigió en 3.19.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'give-run-migration' parameter in all versions up to, and including, 3.18.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Solución: Update to version 3.19.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 3.16.4; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the give_company_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
Solución: Update to version 3.16.4, or a newer patched version
El proveedor lo corrigió en 3.16.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2.
Solución: Update to version 3.16.2, or a newer patched version
El proveedor lo corrigió en 3.16.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.
Solución: Update to version 3.16.2, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
El proveedor lo corrigió en 3.16.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.15.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an action they should not have access to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 3.16.0, or a newer patched version
El proveedor lo corrigió en 3.16.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Solución: Update to version 3.16.0, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
El proveedor lo corrigió en 3.14.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
Solución: Update to version 3.14.2, or a newer patched version
El proveedor lo corrigió en 3.14.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read attachment paths and delete attachment files.
Solución: Update to version 3.14.2, or a newer patched version
El proveedor lo corrigió en 3.14.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.
Solución: Update to version 3.14.0, or a newer patched version
El proveedor lo corrigió en 3.14.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handle_request' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edit event ticket settings if the Events beta feature is enabled.
Solución: Update to version 3.14.0, or a newer patched version
El proveedor lo corrigió en 3.14.2; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.14.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Solución: Update to version 3.14.2, or a newer patched version
El proveedor lo corrigió en 3.14.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.
Solución: Update to version 3.14.0, or a newer patched version
CWE-639: Authorization Bypass Through User-Controlled Key
El proveedor lo corrigió en 3.12.1; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Solución: Update to version 3.12.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 3.11.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 3.11.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with give manager-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Solución: Update to version 3.5.0, or a newer patched version
El proveedor lo corrigió en 3.7.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 3.7.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
El proveedor lo corrigió en 3.6.0; esa versión aún no está en el repositorio.
1 versión de este repositorio está afectada: 3.5.1
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 3.6.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Solución: Update to version 3.4.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 3.3.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.33.4, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to unauthorized donation form access due to a missing check on the handleBeforeGateway function that would ensure that a donation form can be used and is not trashed in versions up to, and including, 2.33.1. There is no real security impact, but such trashed donation forms could still receive donations in vulnerable versions.
Solución: Update to version 2.33.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.33.4, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.33.4, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The Give - Donation Plugin plugin for WordPress is vulnerable to privilege escalation due to an insufficient capability check when updating default roles in versions up to, and including, 2.33.0. This makes it possible for authenticated attackers with Give Manager privileges to elevate their privileges to those of an administrator by setting the default role in the plugin's settings.
Solución: Update to version 2.33.1, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.25.3 via deserialization of untrusted input via the $output['main_key'] value. This allows authenticated attackers, with administrative privileges, to inject a PHP Object that will deserialize upon a data export. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Solución: Update to version 2.26.0, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_donation_import_callback function. This makes it possible for unauthenticated attackers to process the import of donations via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.3, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_ajax_delete_payment_note function. This makes it possible for unauthenticated attackers to add donation notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.3, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.2. This is due to missing or incorrect nonce validation on the give_ajax_store_payment_note function. This makes it possible for unauthenticated attackers to add donation notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.3, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Improper Authorization in versions up to, and including, 2.25.1. This makes it possible for authenticated attackers with contributor-level permissions to delete content from a vulnerable site.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with author-level access, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 2.25.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.25.1 via the 'give_get_content_by_ajax_handler'. This can allow authenticated attackers with administrator-level privileges to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'render_dropdown' AJAX function. This makes it possible for unauthenticated attackers to execute JavaScript in the browser of an administrator via forged request granted a CSV file containing JavaScript in the column names has been uploaded and they can trick a site administrator into performing an action such as clicking on a link. Note that it is only possible to upload CSV files containing JavaScript tags in cases where ALLOW_UNFILTERED_UPLOADS is enabled.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.25.1 via the 'print_csv_rows' function used in exporting CSV files. This allows attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Solución: Update to version 2.25.2, or a newer patched version
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'process_bulk_action' AJAX function. This makes it possible for unauthenticated attackers to perform various bulk actions including deleting content via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'give_cache_flush' AJAX function. This makes it possible for unauthenticated attackers to flush the GiveWP cache via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'save' AJAX function. This makes it possible for unauthenticated attackers to import donations via forged request granted a CSV file containing those donations has been uploaded and they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.25.2, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form_grid' shortcode in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: Update to version 2.25.2, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to SQL Injection versions up to, and including, 2.23.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Solución: Update to version 2.24, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.23.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page
Solución: Update to version 2.24, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Solución: Update to version 2.21.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.21.2. This is due to missing or incorrect nonce validation on the can_export function. This makes it possible for unauthenticated attackers to trigger report exports via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Solución: Update to version 2.21.3, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
Solución: Update to version 2.21.0, or a newer patched version
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Solución: Update to version 2.17.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Solución: Update to version 2.17.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Solución: Update to version 2.17.3, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
Solución: Update to version 2.12.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
Solución: Update to version 2.10.4, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
Solución: Update to version 2.10.0, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.
Solución: Update to version 2.5.5, or a newer patched version
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Solución: Update to version 2.5.1, or a newer patched version
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Versión corregida disponible en el repositorio: 3.5.1
composer require meteorgpl-plugin/give:^3.5.1
Ninguna versión de este repositorio está afectada.
Detalles
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Scripting in versions before 0.8.5 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Solución: Update to version 0.8.5, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
Datos de vulnerabilidades: Wordfence Intelligence. Cada aviso enlaza a su registro allí.
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
