CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2024-11921 – Give < 3.19.0 - Reflected XSS
https://notcve.org/view.php?id=CVE-2024-11921
06 Dec 2024 — The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. El complemento GiveWP para WordPress anterior a la versión 3.19.0 no desinfecta ni escapa un parámetro antes de mostrarlo nuevamente en la página, lo que genera un error de Cross-Site Scripting reflejado que podría usarse contra usuarios con privilegios elevados, como el administra... • https://packetstorm.news/files/id/183282 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5977 – GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
https://notcve.org/view.php?id=CVE-2024-5977
18 Jul 2024 — The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with GiveWP Worker-level access and above, to delete and update arbitrary posts. El complemento GiveWP – Donation Plugin and Fundraising Platform para WordPress es vulnerable a la referencia directa de obj... • https://plugins.trac.wordpress.org/browser/give/trunk/src/DonationForms/V2/Endpoints/FormActions.php#L96 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51415 – WordPress GiveWP Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-51415
19 Jan 2024 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform allows Stored XSS.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 3.2.2. Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en GiveWP GiveWP – Donation Plugin and Fundraising Platform permite almacenar XSS. Este problema afecta a GiveWP – Donati... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-3-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4246 – GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation
https://notcve.org/view.php?id=CVE-2023-4246
31 Oct 2023 — The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_remote_install_handler function. This makes it possible for unauthenticated attackers to install and activate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento GiveWP para WordPress es vulnerable a Cross-Site Request For... • https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L258 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4248 – GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion
https://notcve.org/view.php?id=CVE-2023-4248
31 Oct 2023 — The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento GiveWP para WordPress es vulnerable ... • https://plugins.trac.wordpress.org/browser/give/trunk/includes/gateways/stripe/includes/admin/admin-actions.php?rev=2585755#L361 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4247 – GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation
https://notcve.org/view.php?id=CVE-2023-4247
31 Oct 2023 — The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento GiveWP para WordPress es vulnerable a Cross-Site Request Forgery en versiones hast... • https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L333 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32513 – WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection
https://notcve.org/view.php?id=CVE-2023-32513
10 May 2023 — Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3. Vulnerabilidad de deserialización de de datos no confiables en GiveWP GiveWP – Donation Plugin and Fundraising Platform. Este problema afecta a GiveWP – Donation Plugin and Fundraising Platform: desde n/a hasta 2.25.3. The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, a... • https://patchstack.com/database/vulnerability/give/wordpress-give-donation-plugin-plugin-2-25-3-php-object-injection-vulnerability?_s_id=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23668 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23668
08 Mar 2023 — Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form_grid' shortcode in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40312 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)
https://notcve.org/view.php?id=CVE-2022-40312
08 Mar 2023 — Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1. Vulnerabilidad de Cross-Site Request Forgery (SSRF) en GiveWP GiveWP – Donation Plugin and Fundraising Platform. Este problema afecta a GiveWP – Donation Plugin and Fundraising Platform: desde n/a hasta 2.25.1. The GiveWP plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, a... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25450 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-25450
08 Mar 2023 — Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'give_cache_flush' AJAX function. This makes it possible for unauthenticated attackers to flush the GiveWP cache via forged request granted they can trick a site administrator into performing an acti... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-cross-site-request-forgery-csrf-via-give-cache-flush-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •