PT-2023-13784 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions through 2.25.1 Description: A Server-Side Request Forgery SSRF issue affects the GiveWP – Donation Plugin and Fundraising Platform. This allows an attacker to trick the server into...

WordPress Plugin GiveWP Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

GiveWP < 2.33.4 - Cross-Site Request Forgery to Stripe Integration Deletion

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givestripedisconnectconnectstripeaccount function. This makes it possible for unauthenticated attackers to...

GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin deactivation

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpdisconnect function. This makes it possible for unauthenticated attackers to deactivate the SendW...

GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin installation

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpremoteinstallhandler function. This makes it possible for unauthenticated attackers to install an...

GiveWP < 2.33.2 - Missing Authorization via handleBeforeGateway

Description The GiveWP plugin for WordPress is vulnerable to unauthorized donation form access due to a missing check on the handleBeforeGateway function that would ensure that a donation form can be used and is not trashed in versions up to, and including, 2.33.1. There is no real security impac...

CVE-2023-22719

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1...

CVE-2023-22719

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1...

Design/Logic Flaw

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1...

CVE-2023-22719 WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1...

CVE-2023-22719

The CVE-2023-22719 entry documents a CSV Injection vulnerability in the WordPress GiveWP plugin (affected: GiveWP &lt;= 2.25.1). Root cause: improper neutralization of formula elements in CSV files. Impact: potential exposure of high-severity data integrity/confidentiality/availability issues per...

CVE-2023-22719 WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1...

WordPress Plugin GiveWP - Donation Plugin and Fundraising Platform Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-18662 · Givewp · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP versions through 2.25.1 Description: The issue is related to the improper neutralization of formula elements in a CSV file. This affects the functionality of the software, potentially leading to unintended consequences. Recommendations...

WordPress GiveWP Plugin <= 2.33.1 is vulnerable to Broken Access Control

Software GiveWP Type Plugin Vulnerable versions = 2.33.1 Fixed in 2.33.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47183 Patch priority Low CVSS severity Low 5.3 Developer Liquid Web / StellarWP PSID d8a2ba17a941 Credits Revan Arifio Required privile...

WordPress GiveWP Plugin <= 2.33.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software GiveWP Type Plugin Vulnerable versions = 2.33.3 Fixed in 2.33.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4246 Patch priority Low CVSS severity Low 4.3 Developer Liquid Web / StellarWP PSID fe19cf753f7f Credits Marco Wotschka...

WordPress GiveWP Plugin <= 2.33.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software GiveWP Type Plugin Vulnerable versions = 2.33.3 Fixed in 2.33.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4248 Patch priority Low CVSS severity Low 4.3 Developer Liquid Web / StellarWP PSID 0cdf1d1b888d Credits Marco Wotschka...

WordPress GiveWP Plugin <= 2.33.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software GiveWP Type Plugin Vulnerable versions = 2.33.3 Fixed in 2.33.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4247 Patch priority Low CVSS severity Low 4.3 Developer Liquid Web / StellarWP PSID fe1779b76e9b Credits Marco Wotschka...

GiveWP Plugin for WordPress < 2.3.1 Cross-Site Scripting

The WordPress GiveWP Plugin installed on the remote host is affected by a Reflected Cross-Site Scripting XSS vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

WordPress GiveWP Plugin <= 2.33.0 is vulnerable to Privilege Escalation

Software GiveWP Type Plugin Vulnerable versions = 2.33.0 Fixed in 2.33.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-41665 Patch priority High CVSS severity High 7.2 Developer Liquid Web / StellarWP PSID db573163f3a2 Credits Rafie...