CVE-2024-5932

CVE-2024-5932 的 PoC 致谢： https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ 本 PoC 仅用于教育目的。我不对任何不当使用此代码的行为承担责任，尤其是当它可能用于利用或缓解任何漏洞（CVE）时。...

GiveWP <= 2.9.7 - Cross-Site Scripting

GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions before 2.10.0 is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in the admin Donors page. id: CVE-2021-24213 info: name: GiveWP = 2.9.7 - Cross-Site Scripting author: Shivam Kamboj severity: medium...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

GiveWP - Missing Authorization to Settings Update

GiveWP plugin through 2.5.9 for WordPress contains an unauthenticated settings change caused by insecure access in includes/gateways/stripe/includes/admin/admin-actions.php, letting attackers modify settings without authentication, exploit requires no authentication. id: CVE-2020-20627 info: name...

GiveWP <= 4.16.7.1 - Remote Code Execution

GiveWP = 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input id: CVE-2026-82222 info: name: GiveWP = 4.16.7.1 - Remote Code Execution author: 0xAkoko,pdteam...

CVE-2024-8353

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias acuokon, quien descubrió esta vulnerabilidad. Introducción Análisis adicional de CVE-2024-5932 EQST Insight R&Tarchivo PDF. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Inyección de Objetos PHP no Autenticada Descripción El plugin GiveWP – Donation Plugin and Fundraising Platform para WordPress es vulnerable a la Inyección de Objetos PHP en todas las versiones hasta la 3.19.2 incluida,...

GiveWP - PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. id: CVE-2024-5932 info: name: GiveWP - PHP Object Injection author:...

CVE-2025-22777

CVE-2025-22777 GiveWP – 捐赠插件与筹款平台 = 3.19.3 - 未认证的 PHP 对象注入 描述 GiveWP – 捐赠插件与筹款平台 WordPress 插件在包括 3.19.3 在内的所有版本中存在 PHP 对象注入漏洞，攻击者可通过捐赠表单中的 'company' 参数反序列化不受信任的输入。这使得未认证的攻击者能够注入 PHP 对象。此外，存在 POP 链，允许攻击者删除服务器上的任意文件，进而可能实现远程代码执行。请注意，该漏洞绕过了对 CVE-2024-12877 的修复。 详情 类型 : 插件 别名 : give 受影响版本 : 3.19.3 CV...

CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework CVE-2026-82222 - GiveWP Unauthenticated RCE Exploit Mass Scanner + Auto-Detection + Multi-Threading + Interactive Shell 📋 Daftar Isi | Tabla de Contenidos Overview Fitur Utama | Características Principales Detalles de la Vulnerabilidad Instalasi |...

CVE-2024-8353-PoC

CVE-2024-8353 的概念验证代码 此仓库包含一个脚本，用于利用WordPress的GiveWP插件中的CVE-2024-8353漏洞。该漏洞允许未经认证的PHP对象注入，可能导致远程代码执行。 概述 提供的脚本演示了该利用： Python脚本 ：自动化识别易受攻击的表单、检索nonce以及传递有效载荷以触发漏洞的过程。 PHP脚本 ：作为精心构造的有效载荷，展示反序列化攻击机制。 漏洞描述...

CVE-2026-82222

CVE-2026-82222 — GiveWP Autor: Rx019 CVSS: 10.0 Crítico Tipo: Inyección de Objetos PHP No Autenticada → Ejecución Remota de Código Plugin: GiveWP give — Plugin de Donaciones y Plataforma de Recaudación de Fondos Afectado: Parcheado: 4.16.8 Descripción GiveWP almacena el lastname de un donante en ...

CVE-2026-82222-MassExploit

CVE-2026-82222 — Ejecución Remota de Código No Autenticada en el Plugin GiveWP de WordPress -red.svg Ejecución Remota de Código Crítica No Autenticada CVSS 9.8 — GiveWP ≤ 4.16.7.1 Esta herramienta explota CVE-2026-82222 , una vulnerabilidad en el plugin GiveWP de WordPress que permite a atacantes...

cve-2026-82222-poc

CVE-2026-82222 Inyección de objetos PHP no autenticada a RCE en GiveWP = 4.16.7.1. Parcheado en 4.16.7.2...

CVE-2024-12877-Exploit

GO-TO CVE – CVE-2024-12877-漏洞利用 第66周 | 作者：Ali Soltani soltanali0 欢迎来到 GO-TO CVE 系列第66周 ，我们在此剖析漏洞、分析根本原因，并在安全、教育化的环境中展示实用的利用技术。 🚨 概览 CVE-2024-12877 是 GiveWP （最广泛使用的 WordPress 捐赠插件之一）中的一个 PHP 对象注入 漏洞。对用户可控输入不安全地使用 unserialize 允许攻击者触发 PHP 魔术方法（如 wakeup），可能导致： 远程代码执行 RCE ⚡ 敏感数据窃取 🕵️‍♂️ 权限提升 🔑 完全服务器沦陷...

givewp-cve-2026-82222-rce-lab

CVE-2026-82222 — Laboratorio de Validación de RCE Solo-Marcador para GiveWP Material de investigación de seguridad para reproducir y validar CVE-2026-82222 en un laboratorio Docker aislado. Para el PoC de RCE directo y el escaneo de URL, useCVE-2026-8222-RCE.py Veredicto Estado: probado en el...

VulnCheck KEV: CVE-2026-82222

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1...

CVE-2026-82222

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1...

CVE-2026-5510

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-82222 WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1...