GiveWP – Donation Plugin and Fundraising Platform

GiveWP does not check the required editing capability when processing donor-address changes. A user granted donor-report viewing access but not donor-edit access can add, modify or delete the stored address of any donor. Report-view permission is the disclosed prerequisite; this is not established for an arbitrary Subscriber. The handler, donor-ID parameter and address-field names are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP incorrectly resolves which page a page-capability request applies to. A user with a custom fundraising role can use the resulting authorization error to edit, publish and read pages owned by other users, including administrators. The exact role name, capability request and page-ID handling function are not disclosed in the export; this does not establish administrator impersonation. Published affected versions: < 4.19.0.1.

GiveWP insufficiently sanitizes and escapes a donation-form template setting before inserting it into an HTML attribute. A user with a custom GiveWP form-editing role can store attacker-controlled script that executes when a visitor or administrator opens the affected donation form. The setting name, save endpoint and rendering function are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP reads a user-supplied filename without adequate validation. A user with a high-privilege custom role can traverse paths to disclose JSON-parseable files anywhere on the server and overwrite the plugin’s stored configuration. The JSON-parseability restriction is part of the disclosed read primitive; unrestricted arbitrary-file disclosure or filesystem writes are not established. The exact role, file-reading endpoint and filename parameter are not disclosed in the export. Published affected versions: < 4.19.0.1.

GiveWP renders donation forms through a public front-end route without checking form status or caller capability. An unauthenticated visitor can retrieve content and settings from draft, pending, private and scheduled forms that WordPress would otherwise keep non-public. The route identifier, selector parameter and exact exposed setting fields are not disclosed in the export. Published affected versions: < 4.19.0.1.

A Contributor or higher controls filter_by, layout, sort_by and order_by attributes of the givewp_campaign_grid shortcode. CampaignGridShortcode::parseAttributes encodes these as JSON but inserts the result into a single-quoted HTML attribute without attribute escaping, allowing stored script execution when the grid renders. Affected versions: <= 4.17.0. The matching official changelog confirms 4.18.0 as fixed for this CVE.

The supplied vector requires no attacker account. Caller-controlled identity claims are accepted without sufficient authentication, allowing identity spoofing and unauthorized integrity changes. The export does not identify the endpoint, identity field, verification operation or changed object; a particular payment or account-takeover chain is not established. No victim interaction is required by the vector. The vector reports no confidentiality impact, high integrity impact, no availability impact. Affected versions: <= 4.16.8.1. The authoritative export identifies 4.16.9 as fixed for this CVE.

The supplied vector requires no attacker account. A caller can reach an operation without the intended permission check. The export does not identify the endpoint, action, object, selector parameter or precise protected operation. Unauthorized changes are possible, but account takeover or code execution is not established. The vector reports no confidentiality impact, low integrity impact, no availability impact. No victim interaction is required by the vector. Affected versions: <= 4.18.0. The authoritative export identifies 4.18.0.1 as fixed for this CVE.

No attacker login is required. Attacker-controlled content is rendered in browser output without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The export does not distinguish stored from reflected XSS. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 4.17.0. The authoritative export identifies 4.18.0 as fixed for this CVE.

No attacker login is required. An attacker can cross a permission boundary and gain privileges beyond those intended for the caller. The role-changing operation, target privilege and endpoint are undisclosed. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector rates attack complexity as high; the extra prerequisite is undisclosed. The vector requires no victim interaction. Affected versions: <= 4.17.0. The authoritative export identifies 4.18.0 as fixed for this CVE.

The supplied CVSS vector requires a low-privilege authenticated account; the minimum WordPress role is not disclosed. Attacker-controlled content is stored and subsequently rendered without sufficient neutralization, allowing script execution in a visitor's browser under the site's origin. A victim must view the affected output; the export does not identify the field or establish that administrators are exposed. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact request-to-operation path is undisclosed. Affected versions: <= 4.17.0. The authoritative export identifies 4.18.0 as fixed for this CVE.

Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. Attacker-controlled object identifiers are not adequately bound to the requester's authorization. The affected objects, fields and allowed read or write operations are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 4.17.0.

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. The export reports unauthorized disclosure, but does not enumerate the exposed fields or retrieval endpoint. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 4.17.0.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. The reported impact is browser script execution in the affected site's origin. The injected field, rendering context and exact victim interaction are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 4.17.0.

Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9. The export identifies a bypass but does not disclose the request path, bypassed check or account/data scope. The supplied CVSS vector requires no attacker privileges. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 4.17.0.

GiveWP from 4.16.6 up to but not including 4.16.8.1: An unauthenticated requester can exploit inconsistent donor-email normalization between storage and lookup to be resolved as another donor. The attacker can then set the WordPress password of any account linked to that donor, including an administrator account if one is linked. The export does not disclose the email representation, route, parameters or reset handler; an unlinked account is not established as reachable.

GiveWP through 4.16.7.1 deserializes untrusted request data, allowing an unauthenticated attacker to inject PHP objects. The CNA scores the issue at 10.0 with complete confidentiality, integrity and availability impact.

GiveWP through 4.14.4 passes the give_form shortcode's continue_button_title and display_style attributes through sanitize_text_field() but does not escape them for their HTML data-attribute context. A Contributor can store script that executes when a visitor opens the affected page.

GiveWP is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.16.5.1.

GiveWP is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 4.16.6.

GiveWP is affected by cross-site scripting. Exploitation requires an authenticated donor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a to < 4.16.6.

GiveWP is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a to < 4.16.6.

An unauthenticated visitor can submit attacker-controlled content that GiveWP 4.16.5 and earlier renders without sufficient output encoding, allowing script execution in a victim's browser under the site's origin.

GiveWP through 4.16.3 accepts attacker-controlled input through an unauthenticated request path and places it into a browser-executable output context without adequate neutralization. A victim who opens the crafted output can run script in the site's origin.

GiveWP is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 4.16.3.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.16.3.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.16.1.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. Exploitation requires an authenticated author account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.16.0.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is <= 4.15.3.

GiveWP is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.14.2.

GiveWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.14.5.

GiveWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.14.5.

GiveWP is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GiveWP is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. Exploitation requires an authenticated contributor account. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP – Donation Plugin and Fundraising Platform is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP – Donation Plugin and Fundraising Platform is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

GiveWP – Donation Plugin and Fundraising Platform is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP – Donation Plugin and Fundraising Platform is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

GiveWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

GiveWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP – Donation Plugin and Fundraising Platform is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GiveWP is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GiveWP is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

GiveWP – Donation Plugin and Fundraising Platform is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

GiveWP – Donation Plugin and Fundraising Platform is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.

GiveWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Give is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Give is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

GiveWP is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

GiveWP is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Give is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.