CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4247 – GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation
https://notcve.org/view.php?id=CVE-2023-4247
31 Oct 2023 — The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_sendwp_disconnect function. This makes it possible for unauthenticated attackers to deactivate the SendWP plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento GiveWP para WordPress es vulnerable a Cross-Site Request Forgery en versiones hast... • https://plugins.trac.wordpress.org/browser/give/trunk/includes/admin/misc-functions.php?rev=2772225#L333 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4248 – GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion
https://notcve.org/view.php?id=CVE-2023-4248
31 Oct 2023 — The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the give_stripe_disconnect_connect_stripe_account function. This makes it possible for unauthenticated attackers to deactivate the plugin's stripe integration settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. El complemento GiveWP para WordPress es vulnerable ... • https://plugins.trac.wordpress.org/browser/give/trunk/includes/gateways/stripe/includes/admin/admin-actions.php?rev=2585755#L361 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32513 – WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection
https://notcve.org/view.php?id=CVE-2023-32513
10 May 2023 — Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3. Vulnerabilidad de deserialización de de datos no confiables en GiveWP GiveWP – Donation Plugin and Fundraising Platform. Este problema afecta a GiveWP – Donation Plugin and Fundraising Platform: desde n/a hasta 2.25.3. The GiveWP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, a... • https://patchstack.com/database/vulnerability/give/wordpress-give-donation-plugin-plugin-2-25-3-php-object-injection-vulnerability?_s_id=cve • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22719 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection
https://notcve.org/view.php?id=CVE-2023-22719
08 Mar 2023 — Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. Neutralización inadecuada de elementos de fórmula en una vulnerabilidad de CSV File en GiveWP. Este problema afecta a GiveWP: desde n/a hasta 2.25.1. The GiveWP plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.25.1 via the 'print_csv_rows' function used in exporting CSV files. This allows attackers to embed untrusted input into exported ... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-csv-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23668 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23668
08 Mar 2023 — Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions. The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form_grid' shortcode in versions up to, and including, 2.25.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-contributor-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-40312 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)
https://notcve.org/view.php?id=CVE-2022-40312
08 Mar 2023 — Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1. Vulnerabilidad de Cross-Site Request Forgery (SSRF) en GiveWP GiveWP – Donation Plugin and Fundraising Platform. Este problema afecta a GiveWP – Donation Plugin and Fundraising Platform: desde n/a hasta 2.25.1. The GiveWP plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, a... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25450 – WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-25450
08 Mar 2023 — Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions. The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.25.1. This is due to missing or incorrect nonce validation on the 'give_cache_flush' AJAX function. This makes it possible for unauthenticated attackers to flush the GiveWP cache via forged request granted they can trick a site administrator into performing an acti... • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-25-1-cross-site-request-forgery-csrf-via-give-cache-flush-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-0224 – GiveWP < 2.24.1 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2023-0224
19 Jan 2023 — The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks El complemento de WordPress GiveWP anterior a 2.24.1 no escapa correctamente a la entrada del usuario antes de llegar a las consultas SQL, lo que podría permitir a atacantes no autenticados realizar ataques de inyección SQL. The GiveWP plugin for WordPress is vulnerable to SQL Injection versions up to, and including, 2.23.2 due t... • https://givewp.com/core-2-24-0-vulnerability-patched • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4448 – GiveWP < 2.24.0 - Contributor+ Stored XSS
https://notcve.org/view.php?id=CVE-2022-4448
19 Jan 2023 — The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks The GiveWP for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.23.2 due to insufficient input sanitization and output escaping on user supplied attributes. T... • https://wpscan.com/vulnerability/ce467a2e-081e-4a6c-bfa4-29e4447ebd3b • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31475 – WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability
https://notcve.org/view.php?id=CVE-2022-31475
12 Jul 2022 — Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. Una vulnerabilidad en la lectura de archivos arbitraria por medio de la función Export en el plugin GiveWP de GiveWP versiones anteriores a 2.20.2 incluyéndola, en WordPress • https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-2-20-2-authenticated-arbitrary-file-read-via-export-function-vulnerability • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-284: Improper Access Control CWE-552: Files or Directories Accessible to External Parties •