# GiveWP – Donation Plugin and Fundraising Platform

> Accept donations and begin fundraising with GiveWP, the highest rated WordPress donation plugin for online giving.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 03:07 UTC.

## Facts (WordPress.org)

- Slug: `give`
- Author: Nexcess
- Version: 4.19.1.1
- Active installs: 100,000+
- Last update: 2026-11-03 (3 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.9, PHP 7.4
- Tags: crowdfunding, donate, donation, fundraising, recurring donations
- Page: https://wordpress.org/plugins/give/

## Checks (against WordPress 7.1.4)

- OK: Updated 3 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Behind ↔ Current, Heavy ↔ Light, Pushy ↔ Fair, Closed ↔ Agent-ready, Leaves a mess ↔ Clean exit, Focused ↔ All-in-one (personality).

## Known vulnerabilities

- 2026-11-04 HIGH: Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter (up to 4.19.1). CVE-2026-118193, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2ab1544-2428-4c93-b973-8280ff7a2903?source=api-prod
- 2026-10-30 MEDIUM: Missing Authorization (up to 4.19.0.1). CVE-2026-116853, https://www.wordfence.com/threat-intel/vulnerabilities/id/1c69162b-2e9e-4cf2-9db5-e2a9be00cbd9?source=api-prod
- 2026-10-26 MEDIUM: Unauthenticated Donation Amount Restriction Bypass (up to 4.19.0.0). CVE-2026-111974, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b13b275-e2d9-427a-aed7-e52cee13e05d?source=api-prod
- 2026-10-25 MEDIUM: Unauthenticated Information Exposure (up to 4.19.0.0). CVE-2026-111976, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1da9295-e43c-4dea-b035-8ad165fc1d73?source=api-prod
- 2026-10-25 MEDIUM: Authenticated (Give Manager+) Path Traversal (up to 4.19.0.0). CVE-2026-111978, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8d19086-53db-49f3-bc29-88ef869cc18b?source=api-prod
- 2026-10-25 MEDIUM: Authenticated (Give Worker+) Stored Cross-Site Scripting (up to 4.19.0.0). CVE-2026-111979, https://www.wordfence.com/threat-intel/vulnerabilities/id/231b1b64-96fd-4d58-a312-2bdc4a05090a?source=api-prod
- 2026-10-25 MEDIUM: Missing Authorization (up to 4.19.0.0). CVE-2026-111980, https://www.wordfence.com/threat-intel/vulnerabilities/id/4b9d0ef9-ec09-4c72-9090-0f676976ff82?source=api-prod
- 2026-10-25 MEDIUM: Missing Authorization (up to 4.19.0.0). CVE-2026-111981, https://www.wordfence.com/threat-intel/vulnerabilities/id/b33978d0-2680-44ab-9bdf-e0db1910fb6a?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes (up to 4.17.0). CVE-2026-97643, https://www.wordfence.com/threat-intel/vulnerabilities/id/cc825b2f-43d0-42f0-972d-7d361f7e0b59?source=api-prod
- 2026-10-09 MEDIUM: Unauthenticated Payment Bypass (up to 4.16.8.1). CVE-2026-96333, https://www.wordfence.com/threat-intel/vulnerabilities/id/04aca055-b62a-4c20-8347-0648a8545ef2?source=api-prod
- 2026-10-08 MEDIUM: Missing Authorization (up to 4.18.0). CVE-2026-106600, https://www.wordfence.com/threat-intel/vulnerabilities/id/d32b458f-9fc3-4bcc-8009-9832070a7edb?source=api-prod
- 2026-10-06 HIGH: Unauthenticated Privilege Escalation (up to 4.17.0). CVE-2026-104405, https://www.wordfence.com/threat-intel/vulnerabilities/id/d57be728-6adc-401f-be90-e28734f85d41?source=api-prod
- 2026-10-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.17.0). CVE-2026-104672, https://www.wordfence.com/threat-intel/vulnerabilities/id/fcf740e1-5dbe-4849-a8b8-02d21b4d5543?source=api-prod
- 2026-10-05 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.17.0). CVE-2026-104404, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1e820d0-7d94-43d3-98db-db2b249b0a63?source=api-prod
- 2026-09-30 MEDIUM: Unauthenticated User Impersonation (up to 4.16.9). CVE-2026-97196, https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9e5440-9d66-416b-899f-2b453294885d?source=api-prod
- 2026-09-30 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.16.9). CVE-2026-96830, https://www.wordfence.com/threat-intel/vulnerabilities/id/22b89c2f-a42d-4e2f-b344-81d8363a332f?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 4.16.9). CVE-2026-96834, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a1a9cce-135a-4a5e-a477-ee2615237642?source=api-prod
- 2026-09-30 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 4.16.9). CVE-2026-97066, https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf27806-e521-40b5-8ab6-1f90f3957d06?source=api-prod
- 2026-09-21 MEDIUM: Unauthenticated Arbitrary Shortcode Execution (up to 4.16.8). CVE-2026-85113, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d59151c-aa50-4183-b429-143580961cb1?source=api-prod
- 2026-09-16 HIGH: Unauthenticated Privilege Escalation (up to 4.16.8.0). CVE-2026-85530, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3d597c3-fec9-4dda-a539-0df1d9358a15?source=api-prod
- 2026-08-28 CRITICAL: Unauthenticated PHP Object Injection to Remote Code Execution (up to 4.16.7.1). CVE-2026-82222, https://www.wordfence.com/threat-intel/vulnerabilities/id/49c3be3f-60b3-4b83-9683-a08e8e1cf9e9?source=api-prod
- 2026-08-28 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (up to 4.14.4). CVE-2026-5510, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd26a390-0de5-4699-a790-cac86bf4a057?source=api-prod
- 2026-08-18 MEDIUM: Missing Authorization (before 4.16.6). CVE-2026-73348, https://www.wordfence.com/threat-intel/vulnerabilities/id/5981b937-189f-4dc3-baf0-ee0d194229eb?source=api-prod
- 2026-08-18 MEDIUM: Missing Authorization (up to 4.16.5.1). CVE-2026-73352, https://www.wordfence.com/threat-intel/vulnerabilities/id/d60540ec-e176-42f3-a987-141a9aa184c6?source=api-prod
- 2026-08-13 MEDIUM: Missing Authorization (before 4.16.6). CVE-2026-73349, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec23f29-baa3-4bfc-a7b7-d664a81637c1?source=api-prod
- 2026-08-13 MEDIUM: Authenticated (Donor+) Stored Cross-Site Scripting (before 4.16.6). CVE-2026-73357, https://www.wordfence.com/threat-intel/vulnerabilities/id/61d1bc0e-f66f-4bc3-9dfe-2fa19f07999f?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.16.5). CVE-2026-66690, https://www.wordfence.com/threat-intel/vulnerabilities/id/82ff0450-5a76-453e-bb27-45c11fff7419?source=api-prod
- 2026-07-31 MEDIUM: Unauthenticated Payment Bypass (before 4.16.3). CVE-2026-14317, https://www.wordfence.com/threat-intel/vulnerabilities/id/f85478c4-ea66-4bca-b501-2e55425396f7?source=api-prod
- 2026-07-31 MEDIUM: Unauthenticated Recurring Donor Information Disclosure (up to 4.16.2). CVE-2026-14319, https://www.wordfence.com/threat-intel/vulnerabilities/id/95f49cbd-a794-4b39-92cb-9d9c8df82685?source=api-prod
- 2026-07-30 MEDIUM: Authenticated (Custom role+) Stored Cross-Site Scripting (before 4.16.3). CVE-2026-14318, https://www.wordfence.com/threat-intel/vulnerabilities/id/463fea25-c793-42fc-a8a8-28d001978133?source=api-prod
- 2026-07-27 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.16.3). CVE-2026-65441, https://www.wordfence.com/threat-intel/vulnerabilities/id/8a106ebb-f3ec-4995-9717-358b91d468b4?source=api-prod
- 2026-07-23 MEDIUM: Cross-Site Request Forgery (up to 4.16.3). CVE-2026-65464, https://www.wordfence.com/threat-intel/vulnerabilities/id/928dd5c1-c396-4ddb-b910-697884dbc824?source=api-prod
- 2026-07-16 MEDIUM: Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting (up to 4.16.3). CVE-2026-14987, https://www.wordfence.com/threat-intel/vulnerabilities/id/bdd0ba4b-56f1-4f4b-95f7-28c911c8de09?source=api-prod
- 2026-07-02 MEDIUM: Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form (up to 4.16.1). CVE-2026-13704, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee18552b-2814-4598-9b7b-7c919d6d644e?source=api-prod
- 2026-07-01 MEDIUM: Cross-Site Request Forgery (up to 4.15.3). CVE-2026-11981, https://www.wordfence.com/threat-intel/vulnerabilities/id/49954c72-df0d-46ec-a252-8af84dea41bf?source=api-prod
- 2026-07-01 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute (up to 4.16.0). CVE-2026-13246, https://www.wordfence.com/threat-intel/vulnerabilities/id/08f8f489-6b31-45d8-a122-bbaa283a2b10?source=api-prod
- 2026-06-15 MEDIUM: Reflected Cross-Site Scripting (up to 4.14.2). CVE-2026-34900, https://www.wordfence.com/threat-intel/vulnerabilities/id/41c2edae-9788-47ad-bf0b-aa944893c4e2?source=api-prod
- 2026-06-01 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.14.5). CVE-2026-42678, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a541529-ef53-468c-a7f0-0cd6822bd17b?source=api-prod
- 2026-04-29 MEDIUM: Missing Authorization (up to 4.14.5). CVE-2026-42642, https://www.wordfence.com/threat-intel/vulnerabilities/id/eaa01222-28e4-4718-83c1-c7af91ad0326?source=api-prod
- 2026-01-08 MEDIUM: Unauthenticated Arbitrary Shortcode Execution (up to 4.13.1). CVE-2025-66533, https://www.wordfence.com/threat-intel/vulnerabilities/id/b9860e0e-e330-42fc-8a74-336ceb787f39?source=api-prod
- 2025-12-23 MEDIUM: Cross-Site Request Forgery (up to 4.13.1). CVE-2025-67467, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a7ec29-6dc6-4c73-8cc4-4aa4da79941e?source=api-prod
- 2025-11-18 HIGH: Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' (up to 4.13.0). CVE-2025-13206, https://www.wordfence.com/threat-intel/vulnerabilities/id/95823720-e1dc-46c1-887b-ffd877b2fbe5?source=api-prod
- 2025-10-03 MEDIUM: Missing Authorization to Unauthenticated Forms and Campaigns Disclosure (up to 4.10.0). CVE-2025-11227, https://www.wordfence.com/threat-intel/vulnerabilities/id/54db1807-69ff-445c-9e02-9abce9fd3940?source=api-prod
- 2025-10-03 MEDIUM: Missing Authorization to Unauthenticated Forms-Campaign Association (up to 4.10.0). CVE-2025-11228, https://www.wordfence.com/threat-intel/vulnerabilities/id/ddf9a043-5eb6-46fd-88c2-0f5a04f73fc9?source=api-prod
- 2025-08-20 MEDIUM: Missing Authorization to Donation Update (up to 4.5.0). CVE-2025-7221, https://www.wordfence.com/threat-intel/vulnerabilities/id/8766608e-df72-4b9d-a301-a50c64fadc9a?source=api-prod
- 2025-08-05 MEDIUM: Unauthenticated Donor Data Exposure (up to 4.6.0). CVE-2025-8620, https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc7c5a6-513e-4aa8-9538-0ac6fb37c867?source=api-prod
- 2025-07-30 MEDIUM: Authenticated (GiveWP worker+) Stored Cross-Site Scripting (up to 4.5.0). CVE-2025-7205, https://www.wordfence.com/threat-intel/vulnerabilities/id/39e501d8-88a0-4625-aeb0-aa33fc89a8d4?source=api-prod
- 2025-06-18 MEDIUM: Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification (up to 4.3.0). CVE-2025-4571, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f03b4ef-e877-430e-a440-3af0feca818c?source=api-prod
- 2025-03-21 MEDIUM: Authenticated (Subscriber+) Sensitive Information Exposure (up to 3.22.1). CVE-2025-2331, https://www.wordfence.com/threat-intel/vulnerabilities/id/b4d9acfb-bb9d-4b00-b439-c7ccea751f8d?source=api-prod
- 2025-03-14 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function (up to 3.22.0). CVE-2025-2025, https://www.wordfence.com/threat-intel/vulnerabilities/id/40595943-121d-4492-a0ed-f2de1bd99fda?source=api-prod
- 2025-03-03 CRITICAL: Unauthenticated PHP Object Injection (up to 3.19.4). CVE-2025-0912, https://www.wordfence.com/threat-intel/vulnerabilities/id/8a8ae1b0-e9a0-4179-970b-dbcb0642547c?source=api-prod
- 2025-01-10 CRITICAL: Unauthenticated PHP Object Injection (up to 3.19.3). CVE-2025-22777, https://www.wordfence.com/threat-intel/vulnerabilities/id/06a7ff0b-ec6b-490c-9bb0-fbb5c1c337c4?source=api-prod
- 2025-01-10 CRITICAL: Unauthenticated PHP Object Injection (up to 3.19.2). CVE-2024-12877, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2143edf-5423-4e79-8638-a5b98490d292?source=api-prod
- 2024-12-06 MEDIUM: Reflected Cross-Site Scripting (up to 3.18.0). CVE-2024-11921, https://www.wordfence.com/threat-intel/vulnerabilities/id/18c0f717-6825-4421-af53-68f1cf502f81?source=api-prod
- 2024-10-15 CRITICAL: Unauthenticated PHP Object Injection to Remote Code Execution (up to 3.16.3). CVE-2024-9634, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8eb3aa9-fe60-48b6-aa24-7873dd68b47e?source=api-prod
- 2024-09-27 CRITICAL: Unauthenticated PHP Object Injection (up to 3.16.1). CVE-2024-8353, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c?source=api-prod
- 2024-09-26 HIGH: Authenticated (GiveWP Manager+) SQL Injection via order Parameter (up to 3.16.1). CVE-2024-9130, https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3cae01-620d-405e-baf6-2d66a5b429b3?source=api-prod
- 2024-09-25 MEDIUM: Cross-Site Request Forgery (up to 3.15.1). CVE-2024-47315, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ce9bac7-60bb-4880-9e37-4d71f02ee941?source=api-prod
- 2024-08-28 MEDIUM: Unauthenticated Full Path Disclosure (up to 3.15.1). CVE-2024-6551, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a13ce09-b312-4186-b0e2-63065c47f15d?source=api-prod
- 2024-08-19 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Limited File Deletion (up to 3.14.1). CVE-2024-5941, https://www.wordfence.com/threat-intel/vulnerabilities/id/824ec2ba-b701-46e9-b237-53cd7d0e46da?source=api-prod
- 2024-08-19 CRITICAL: Unauthenticated PHP Object Injection to Remote Code Execution (up to 3.14.1). CVE-2024-5932, https://www.wordfence.com/threat-intel/vulnerabilities/id/93e2d007-8157-42c5-92ad-704dc80749a3?source=api-prod
- 2024-08-19 MEDIUM: Missing Authorization to Limited Information Exposure (up to 3.13.0). CVE-2024-5939, https://www.wordfence.com/threat-intel/vulnerabilities/id/a104f88b-deae-465d-b4c1-9a1fc78e5ee9?source=api-prod
- 2024-08-19 MEDIUM: Missing Authorization to Unauthenticated Event Settings Update (up to 3.13.0). CVE-2024-5940, https://www.wordfence.com/threat-intel/vulnerabilities/id/d3cda8d0-321c-4b15-980e-5ebf49fac367?source=api-prod
- 2024-08-09 HIGH: Unauthenticated PHP Object Injection (up to 3.14.1). CVE-2024-37099, https://www.wordfence.com/threat-intel/vulnerabilities/id/1c9b7866-d4e4-4ed0-a94b-1daef73a10bc?source=api-prod
- 2024-07-18 MEDIUM: Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions (up to 3.13.0). CVE-2024-5977, https://www.wordfence.com/threat-intel/vulnerabilities/id/2dca6c29-9f05-4d82-90e3-834f1dd8005a?source=api-prod
- 2024-06-06 MEDIUM: Reflected Cross-Site Scripting (up to 3.12.0). CVE-2024-35679, https://www.wordfence.com/threat-intel/vulnerabilities/id/1861d943-ac58-4a44-ab50-e39101e82013?source=api-prod
- 2024-05-17 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.10.0). CVE-2024-3714, https://www.wordfence.com/threat-intel/vulnerabilities/id/dd8f5cfa-3431-4617-b2cd-d5a8ce4530f4?source=api-prod
- 2024-04-26 HIGH: Authenticated (GiveWP Manager+) PHP Object Injection (up to 3.4.2). CVE-2024-30229, https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc7bc0a-b209-431f-a9f1-f850b1a1d1b4?source=api-prod
- 2024-04-12 MEDIUM: GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.6.1). CVE-2024-1957, https://www.wordfence.com/threat-intel/vulnerabilities/id/61901d83-0d05-4be8-a318-43bea086293a?source=api-prod
- 2024-03-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.5.1). CVE-2024-1424, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1710f84-e3c1-4fbc-841e-c7c9ccf3a2e5?source=api-prod
- 2024-03-15 MEDIUM: Reflected Cross-Site Scripting (up to 3.3.1). CVE-2024-27987, https://www.wordfence.com/threat-intel/vulnerabilities/id/d8bf1d64-8012-4588-9897-aa8bb0cacfb6?source=api-prod
- 2024-01-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 3.2.2). CVE-2023-51415, https://www.wordfence.com/threat-intel/vulnerabilities/id/d74d71a8-774a-4ebb-b254-0e65a8044319?source=api-prod
- 2023-10-31 MEDIUM: Cross-Site Request Forgery to Stripe Integration Deletion (up to 2.33.3). CVE-2023-4248, https://www.wordfence.com/threat-intel/vulnerabilities/id/2bff8dea-6971-47d4-bd2c-0821687033e5?source=api-prod
- 2023-10-31 MEDIUM: Missing Authorization via handleBeforeGateway (up to 2.33.1). CVE-2023-47183, https://www.wordfence.com/threat-intel/vulnerabilities/id/3b6b1b7e-2ba4-4b72-9e3d-b54c00437cac?source=api-prod
- 2023-10-31 MEDIUM: Cross-Site Request Forgery to plugin installation (up to 2.33.3). CVE-2023-4246, https://www.wordfence.com/threat-intel/vulnerabilities/id/dc5c511f-dc79-468b-a107-cdf50999faf8?source=api-prod
- 2023-10-31 MEDIUM: Cross-Site Request Forgery to plugin deactivation (up to 2.33.3). CVE-2023-4247, https://www.wordfence.com/threat-intel/vulnerabilities/id/e32d9104-5a39-4455-b76a-e24ae787bdfd?source=api-prod
- 2023-08-31 HIGH: Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation (before 2.33.1). CVE-2023-41665, https://www.wordfence.com/threat-intel/vulnerabilities/id/22ff4b09-063b-425e-9d59-be2e5d283186?source=api-prod
- 2023-05-10 MEDIUM: Authenticated (Admin+) PHP Object Injection (up to 2.25.3). CVE-2023-32513, https://www.wordfence.com/threat-intel/vulnerabilities/id/7fa8c406-e64d-4093-a102-436ecfb7dd76?source=api-prod
- 2023-03-23 MEDIUM: Cross-Site Request Forgery (up to 2.25.2). WF-5ea02dd5-d837-471c-aa6a-264ffcedd55d, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ea02dd5-d837-471c-aa6a-264ffcedd55d?source=api-prod
- 2023-03-23 MEDIUM: Cross-Site Request Forgery via give_ajax_delete_payment_note (up to 2.25.2). WF-a2dc1a04-5503-412b-92e7-ed86910abd92, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2dc1a04-5503-412b-92e7-ed86910abd92?source=api-prod
- 2023-03-23 MEDIUM: Cross-Site Request Forgery via give_ajax_store_payment_note (up to 2.25.2). WF-d09a0b62-6556-4be5-a6f2-0cb0edcced3b, https://www.wordfence.com/threat-intel/vulnerabilities/id/d09a0b62-6556-4be5-a6f2-0cb0edcced3b?source=api-prod
- 2023-03-10 MEDIUM: Authenticated (Contributor+) Arbitrary Content Deletion (up to 2.25.1). CVE-2023-23672, https://www.wordfence.com/threat-intel/vulnerabilities/id/a9af1429-32c5-4907-acf4-83efc6727bb8?source=api-prod
- 2023-03-10 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 2.25.1). CVE-2022-40211, https://www.wordfence.com/threat-intel/vulnerabilities/id/b30261e0-1fa1-4794-98f6-851532b7615c?source=api-prod
- 2023-03-08 MEDIUM: Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler (up to 2.25.1). CVE-2022-40312, https://www.wordfence.com/threat-intel/vulnerabilities/id/2379a029-cc0d-4fa2-9aeb-47a4abd6b51a?source=api-prod
- 2023-03-08 MEDIUM: Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown (up to 2.25.1). WF-2a0381b1-9b63-41cb-8125-d22274b98867, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a0381b1-9b63-41cb-8125-d22274b98867?source=api-prod
- 2023-03-08 HIGH: Unauthenticated CSV Injection (up to 2.25.1). CVE-2023-22719, https://www.wordfence.com/threat-intel/vulnerabilities/id/6368c397-0570-4304-a764-869bacc526c7?source=api-prod
- 2023-03-08 MEDIUM: Cross-Site Request Forgery via process_bulk_action (up to 2.25.1). WF-a9939ffe-a5d5-45cb-b673-665acf1ff09d, https://www.wordfence.com/threat-intel/vulnerabilities/id/a9939ffe-a5d5-45cb-b673-665acf1ff09d?source=api-prod
- 2023-03-08 MEDIUM: Cross-Site Request Forgery via give_cache_flush (up to 2.25.1). CVE-2023-25450, https://www.wordfence.com/threat-intel/vulnerabilities/id/c820003b-8f30-4557-a282-e3ad7e403062?source=api-prod
- 2023-03-08 MEDIUM: Cross-Site Request Forgery via save (up to 2.25.1). WF-cb7ec7ad-797b-4a5c-9b1c-31284083faef, https://www.wordfence.com/threat-intel/vulnerabilities/id/cb7ec7ad-797b-4a5c-9b1c-31284083faef?source=api-prod
- 2023-03-08 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode (up to 2.25.1). CVE-2023-23668, https://www.wordfence.com/threat-intel/vulnerabilities/id/cc5f7a07-8117-4305-a72c-6afed80b6bcf?source=api-prod
- 2023-01-19 CRITICAL: Unauthenticated SQL Injection (up to 2.23.2). CVE-2023-0224, https://www.wordfence.com/threat-intel/vulnerabilities/id/89a9d925-6ca3-481f-ba7d-ea9869d51b52?source=api-prod
- 2023-01-19 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 2.23.2). CVE-2022-4448, https://www.wordfence.com/threat-intel/vulnerabilities/id/8a20f582-10e7-4530-8d3c-9bc1e844badd?source=api-prod
- 2022-07-12 MEDIUM: Authenticated Arbitrary File Read (up to 2.20.2). CVE-2022-31475, https://www.wordfence.com/threat-intel/vulnerabilities/id/3fe1bb24-1f60-40f6-9b5e-58e0158bdfd3?source=api-prod
- 2022-07-12 MEDIUM: Authenticated Arbitrary File Creation (up to 2.20.2). CVE-2022-28700, https://www.wordfence.com/threat-intel/vulnerabilities/id/53ddfd2d-7af1-4561-ab76-5cb3238e8f8b?source=api-prod
- 2022-07-11 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 2.21.2). CVE-2022-2215, https://www.wordfence.com/threat-intel/vulnerabilities/id/50b811e0-c1f4-4970-a340-8c1619456e29?source=api-prod
- 2022-07-08 MEDIUM: Cross-Site Request Forgery (up to 2.21.2). CVE-2022-2260, https://www.wordfence.com/threat-intel/vulnerabilities/id/3dc26eaa-2da5-4cd6-b613-4da2faad0f3b?source=api-prod
- 2022-06-17 MEDIUM: Sensitive Information Disclosure (up to 2.20.2). CVE-2022-2117, https://www.wordfence.com/threat-intel/vulnerabilities/id/addae413-1fc5-427f-a5ef-3da705cbeb5b?source=api-prod
- 2022-01-18 MEDIUM: Reflected Cross-Site Scripting via Import Tool (before 2.17.3). CVE-2022-0252, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ccf6945-6f18-410b-9f1a-6d52a3cdda1a?source=api-prod
- 2022-01-18 MEDIUM: Reflected Cross-Site Scripting (before 2.17.3). CVE-2021-25100, https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7e3fe0-561e-40d8-b22c-bf8e7675b87f?source=api-prod
- 2022-01-18 MEDIUM: Reflected Cross-Site Scripting (before 2.17.3). CVE-2021-25099, https://www.wordfence.com/threat-intel/vulnerabilities/id/f90f5f35-ed84-4284-be21-15bfaf10175f?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=give · HTML: https://todaywp.com/plugins/give