GiveWP Vulnerabilities and Affected Products
Vulnerabilities associated with GiveWP – Donation Plugin and Fundraising Platform.
Products
Clear product- givewp13 vulnerabilities
- GiveWP – Donation Plugin and Fundraising Platform6 vulnerabilities
- GiveWP (WordPress plugin)2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-51415MEDIUM | WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2. CWE-79Feb 10, 2024 | CVSS6.5v3.1 | EPSS0.332% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-32513HIGH | WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object InjectionDeserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3. CWE-502Dec 28, 2023 | CVSS7.5v3.1 | EPSS0.592% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-40312MEDIUM | WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1. CWE-918Dec 18, 2023 | CVSS5.5v3.1 | EPSS0.432% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-25450MEDIUM | WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. CWE-352Jun 15, 2023 | CVSS5.4v3.1 | EPSS0.264% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24315MEDIUM | Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues. CWE-79May 17, 2021 | CVSS4.8v3.1 | EPSS0.664% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24213MEDIUM | GiveWP < 2.10.0 - Reflected Cross Site Scripting (XSS)The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page. | CVSS6.1v3.1 | EPSS1.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |