Givewp

WordPress plugin · givewp · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Givewp on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 8.1	GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch CVE.org	>=4.16.6, <4.16.8.1	v4.16.8.1	CVE-2026-85530	Sep 16, 2026
HIGH CVSS 7.5	GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure CVE.org	>=0, <4.16.3	v4.16.3	CVE-2026-14319	Jul 31, 2026
MEDIUM CVSS 5.3	GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111974	Oct 26, 2026
MEDIUM CVSS 5.3	GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111976	Oct 25, 2026
MEDIUM CVSS 6.0	GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111978	Oct 25, 2026
MEDIUM CVSS 6.8	GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111979	Oct 25, 2026
MEDIUM CVSS 5.5	GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111980	Oct 25, 2026
MEDIUM CVSS 6.5	GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name CVE.org	>=4.13.2, <4.16.9	v4.16.9	CVE-2026-85113	Sep 21, 2026
MEDIUM CVSS 5.3	GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass CVE.org	>=0, <4.16.3	v4.16.3	CVE-2026-14317	Jul 31, 2026
MEDIUM CVSS 6.8	GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings CVE.org	>=0, <4.16.3	v4.16.3	CVE-2026-14318	Jul 30, 2026
LOW CVSS 2.7	GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses CVE.org	>=0, <4.19.0.1	v4.19.0.1	CVE-2026-111981	Oct 25, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.