VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 73 known issues Latest disclosed May 16, 2026

GiveWP – Donation Plugin and Fundraising Platform Vulnerabilities

Review known vulnerability records for the WordPress plugin GiveWP – Donation Plugin and Fundraising Platform (`give`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-42678, CVE-2026-34900 and CVE-2026-42642, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
73
High or Critical
16
Patch Coverage
100%
Last Updated
May 19, 2026
Related Security Guides

Use these guides while reviewing GiveWP – Donation Plugin and Fundraising Platform fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize GiveWP – Donation Plugin and Fundraising Platform remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
58
1. Match the Package
Confirm the installed WordPress plugin slug is give before acting on any CVE from this cluster.
2. Sort by Severity
Start with 16 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
73 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-5932 Critical
Remote Code Execution remediation for GiveWP – Donation Plugin and Fundraising Platform

Affected range: Versions up to 3.14.1. Fixed version: 3.14.2.

CVE-2025-0912 Critical
Remote Code Execution remediation for GiveWP – Donation Plugin and Fundraising Platform

Affected range: Versions up to 3.19.4. Fixed version: 3.20.0.

CVE-2024-12877 Critical
Remote Code Execution remediation for GiveWP – Donation Plugin and Fundraising Platform

Affected range: Versions up to 3.19.2. Fixed version: 3.19.3.

CVE-2025-22777 Critical
Remote Code Execution remediation for GiveWP – Donation Plugin and Fundraising Platform

Affected range: Versions up to 3.19.3. Fixed version: 3.19.4.

Priority CVE Quick Links

Fast paths into GiveWP – Donation Plugin and Fundraising Platform CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
66
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.14.1 3.14.2 CVSS 10.0
CVE-2025-0912
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.19.4 3.20.0 CVSS 9.8
CVE-2024-12877
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.19.2 3.19.3 CVSS 9.8
CVE-2025-22777
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.19.3 3.19.4 CVSS 9.8
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.16.3 3.16.4 CVSS 9.8
CVE-2024-8353
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Ob...
 Remote Code Execution Versions up to 3.16.1 3.16.2 CVSS 9.8
CVE-2023-0224
GiveWP <= 2.23.2 - Unauthenticated SQL Injection
 SQL Injection Versions up to 2.23.2 2.24 CVSS 9.8
CVE-2019-13578
GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
 SQL Injection Versions up to 2.5.0 2.5.1 CVSS 9.8
CVE-2024-5932 Critical 3.14.2
CVE-2024-5932 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

CVE-2025-0912 Critical 3.20.0
CVE-2025-0912 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection

CVE-2024-12877 Critical 3.19.3
CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

CVE-2025-22777 Critical 3.19.4
CVE-2025-22777 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection

CVE-2024-9634 Critical 3.16.4
CVE-2024-9634 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution

CVE-2024-8353 Critical 3.16.2
CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform Remote Code Execution

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

CVE-2023-0224 Critical 2.24
CVE-2023-0224 GiveWP – Donation Plugin and Fundraising Platform SQL Injection

GiveWP <= 2.23.2 - Unauthenticated SQL Injection

CVE-2019-13578 Critical 2.5.1
CVE-2019-13578 GiveWP – Donation Plugin and Fundraising Platform SQL Injection

GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for GiveWP – Donation Plugin and Fundraising Platform so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
73 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
8 critical and 8 high severity findings.
Recent CVEs
CVE-2026-42678, CVE-2026-34900 and CVE-2026-42642
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for GiveWP – Donation Plugin and Fundraising Platform

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-42678
CVE-2026-42678: GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inj...

Published
May 16, 2026
Patched Release
4.14.6
Affected Versions
Versions up to 4.14.5
Next Step
Update to 4.14.6 or newer if supported.
Review CVE-2026-42678 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-34900
CVE-2026-34900: GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.14.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Published
Apr 21, 2026
Patched Release
4.14.3
Affected Versions
Versions up to 4.14.2
Next Step
Update to 4.14.3 or newer if supported.
Review CVE-2026-34900 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-42642
CVE-2026-42642: GiveWP <= 4.14.5 - Missing Authorization

The GiveWP plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.14.5. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Published
Mar 02, 2026
Patched Release
4.14.6
Affected Versions
Versions up to 4.14.5
Next Step
Update to 4.14.6 or newer if supported.
Review CVE-2026-42642 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66533
CVE-2025-66533: GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution

The The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.13.1. This is due to the software allowing users to execute an action that does not properly validate a value befo...

Published
Jan 08, 2026
Patched Release
4.13.2
Affected Versions
Versions up to 4.13.1
Next Step
Update to 4.13.2 or newer if supported.
Review CVE-2025-66533 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-67467
CVE-2025-67467: GiveWP <= 4.13.1 - Cross-Site Request Forgery

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated atta...

Published
Dec 23, 2025
Patched Release
4.13.2
Affected Versions
Versions up to 4.13.1
Next Step
Update to 4.13.2 or newer if supported.
Review CVE-2025-67467 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-13206
CVE-2025-13206: GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for una...

Published
Nov 18, 2025
Patched Release
4.13.1
Affected Versions
Versions up to 4.13.0
Next Step
Update to 4.13.1 or newer if supported.
Review CVE-2025-13206 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11227
CVE-2025-11227: GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing...

Published
Oct 03, 2025
Patched Release
4.10.1
Affected Versions
Versions up to 4.10.0
Next Step
Update to 4.10.1 or newer if supported.
Review CVE-2025-11227 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11228
CVE-2025-11228: GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possibl...

Published
Oct 03, 2025
Patched Release
4.10.1
Affected Versions
Versions up to 4.10.0
Next Step
Update to 4.10.1 or newer if supported.
Review CVE-2025-11228 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-7221
CVE-2025-7221: GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the give_update_payment_status() function in all versions up to, and including, 4.5.0. This makes it possible for aut...

Published
Aug 20, 2025
Patched Release
4.6.1
Affected Versions
Versions up to 4.5.0
Next Step
Update to 4.6.1 or newer if supported.
Review CVE-2025-7221 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-8620
CVE-2025-8620: GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CVE-2025-47444 is a dup...

Published
Aug 05, 2025
Patched Release
4.6.1
Affected Versions
Versions up to 4.6.0
Next Step
Update to 4.6.1 or newer if supported.
Review CVE-2025-8620 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-7205
CVE-2025-7205: GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Jul 30, 2025
Patched Release
4.6.0
Affected Versions
Versions up to 4.5.0
Next Step
Update to 4.6.0 or newer if supported.
Review CVE-2025-7205 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-4571
CVE-2025-4571: GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modification of data due to an insufficient capability check on the permissionsCheck functions in all versions up to, and including, 4.3.0. This makes it possible for...

Published
Jun 18, 2025
Patched Release
4.3.1
Affected Versions
Versions up to 4.3.0
Next Step
Update to 4.3.1 or newer if supported.
Review CVE-2025-4571 fixed version details Open CVE Reference