GiveWP – Donation Plugin and Fundraising Platform

Vulnerabilities 112Slug giveLatest version 4.19.0WordPress.org →

Minimum safe version

4.18.0.1

Update to 4.18.0.1 or later to address 112 fixable vulnerabilities

Latest available4.19.0 ✓
High 7.5
2026-10-09< 4.16.9

CVE-2026-96333

CVE
Medium 5.3
2026-10-09< 4.18.0.1

GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization

WordfenceCVE
Medium 6.5
2026-10-09< 4.18.0

GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordfenceCVE
Critical 9.1
2026-09-30< 4.17.0

CVE-2026-97196

CVEWordfence
N/A
2026-09-18< 4.16.8.1

GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation

WordfenceCVE
Critical 10.0
2026-08-28< 4.16.7.2

CVE-2026-82222

CVEWordfence
N/A
2026-08-12< 4.16.3

GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass

WordfenceWordfenceCVE
N/A
2026-07-31< 4.16.3

CVE-2026-14319

CVE
High 7.1
2026-07-31< 4.16.4

GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting

WordfenceCVEWordfence
N/A
2026-07-27< 4.16.4

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery

WordfenceWordfenceCVE
Medium 6.5
2026-01-08< 4.13.2

GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution

WordfenceCVE
Medium 5.4
2025-12-23< 4.13.2

GiveWP <= 4.13.1 - Cross-Site Request Forgery

WordfenceCVE
Medium 4.3
2025-08-21< 4.6.1

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update

EUVDWordfenceCVE
High 7.5
2026-01-07< 4.6.1

FiboSearch <= 1.32.1 - Missing Authorization

WordfenceCVEEUVD
Medium 5.3
2025-08-06< 4.6.1

GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure

EUVDWordfenceCVE
Medium 5.4
2025-07-31< 4.6.0

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting

EUVDWordfenceCVE
Medium 5.4
2025-06-19< 4.3.1

GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification

EUVDWordfenceCVE
Medium 5.3
2025-03-22< 3.22.2

GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure

EUVDWordfenceCVE
Medium 6.5
2025-03-15< 3.22.1

Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function

EUVDWordfenceCVE
Critical 9.8
2025-03-04< 3.20.0

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection

EUVDWordfenceCVE
Critical 9.8
2024-09-30< 3.16.2

WordPress GiveWP Plugin <= 3.16.1 is vulnerable to PHP Object Injection

PatchstackCVEWordfence
Medium 5.4
2024-05-20< 3.11.0

WordPress GiveWP Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

PatchstackCVEWordfence
Medium 5.4
2024-04-15< 3.7.0

WordPress GiveWP Plugin <= 3.6.1 is vulnerable to Cross Site Scripting (XSS)

PatchstackCVEWordfence
High 8.0
2024-04-26< 3.5.0

GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection

WordfenceCVEPatchstack
N/A
< 2.25.3

GiveWP &lt; 2.25.3 - Cross-Site Request Forgery

WPScan
N/A
< 0.8.5

Give - Cross-Site Scripting (XSS)

WPScan
N/A
< 2.21.0

Give &lt; 2.21.0 - Reflected Cross-Site Scripting

WPScan
N/A
2023-03-27< 2.25.3

WordPress GiveWP Plugin <= 2.25.2 is vulnerable to Cross Site Request Forgery (CSRF)

Patchstack
N/A
2023-03-23< 2.25.3

GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note

Wordfence
N/A
2023-03-23< 2.25.3

GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note

Wordfence
N/A
2023-03-23< 2.25.3

GiveWP <= 2.25.2 - Cross-Site Request Forgery

Wordfence
N/A
2023-03-08< 2.25.2

GiveWP <= 2.25.1 - Cross-Site Request Forgery via save

Wordfence
N/A
2023-03-08< 2.25.2

GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown

Wordfence
N/A
2023-03-08< 2.25.2

GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action

Wordfence
N/A
2015-04-20< 0.8.5

GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting

Wordfence
N/A
2022-06-20< 2.21.0

WordPress GiveWP plugin <= 2.20.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2015-04-20< 0.8.5

WordPress Give Plugin <= 0.8.4 - Cross Site Scripting (XSS)

Patchstack
N/A
2019-08-12< 2.5.1

WordPress Give plugin <= 2.5.0 - SQL Injection (SQLi) vulnerability

Patchstack
N/A
2019-09-26< 2.5.5

WordPress GiveWp plugin <= 2.5.4 - Authentication Bypass

Patchstack
N/A
2021-03-23< 2.10.0

WordPress GiveWP plugin <= 2.9.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Patchstack
N/A
2021-04-21< 2.10.2

WordPress GiveWP plugin <= 2.10.1 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Patchstack