805 matches found
CVE-2026-66690
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
CVE-2026-66690
The following CVE pertains to the WordPress GiveWP plugin: Unauthenticated Cross Site Scripting (XSS) in GiveWP versions
CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
CVE-2026-14317
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14319
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...
WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin GiveWP versions = 4.16.5...
CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...
CVE-2026-14317
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14317 GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14317
CVE-2026-14317 : The GiveWP WordPress plugin is vulnerable in versions before 4.16.3. It does not restrict the set of available payment gateways to those enabled by the administrator and derives this from request input, allowing unauthenticated users to complete donations via a payment gateway th...
EUVD-2026-51407
The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...
CVE-2026-14319
The CVE-2026-14319 entry concerns the GiveWP WordPress plugin prior to version 4.16.3. A REST API endpoint does not properly restrict access, allowing unauthenticated users to retrieve recurring-donation records, including names and subscription details of anonymous donors. Root cause is insuffic...
CVE-2026-14318
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...
CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...
EUVD-2026-50995
The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...
CVE-2026-14318
Affected product: GiveWP WordPress plugin (before 4.16.3). Vulnerability: The donation-form template setting is not escaped before output into an HTML attribute, enabling stored XSS. Impact (as described): Users with the GiveWP Worker role and above can inject arbitrary web scripts that execute o...
EUVD-2026-49661
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...
CVE-2026-65441
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...
CVE-2026-65441
CVE-2026-65441 affects WordPress plugin GiveWP up to version 4.16.3, with an Unauthenticated Cross-Site Scripting (XSS) vulnerability. Descriptions in connected documents indicate the issue is present in GiveWP