Threat Entry Updated 2024-08-26

CVE-2024-5939 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to read the setup wizard administrative pages.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-5939

MEDIUM CVSS 5.3 2024-08-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-5977 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-5977

MEDIUM CVSS 5.4 2024-07-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-05

CVE-2024-3714 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-3714

MEDIUM CVSS 6.4 2024-05-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-27

CVE-2024-1957 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-1957

MEDIUM CVSS 6.4 2024-04-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-27

CVE-2024-1424 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2024-1424

MEDIUM CVSS 6.4 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24524 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24524

MEDIUM CVSS 4.8 2021-08-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24315 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24315

MEDIUM CVSS 4.8 2021-05-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24213 - Donation Plugin And Fundraising Platform

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.

PLUGIN Donation Plugin And Fundraising Platform

CVE-2021-24213

MEDIUM CVSS 6.1 2021-04-12

Risk Score

Open Full Technical Breakdown