12 matches found
CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-85113
GiveWP WordPress plugin versions before 4.16.9 fail to remove shortcode delimiters from donor-supplied values (such as donor names) before rendering them on public pages. The shortcode-stripping logic the plugin applies can be defeated by nesting , allowing unauthenticated users to execute arbitr...
EUVD-2019-6318
Malware in sbrugna...
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
Design/Logic Flaw
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
CVE-2019-15317
CVE-2019-15317 affects the WordPress GiveWP plugin (Give plugin) prior to version 2.4.7. Multiple connected sources confirm a cross-site scripting (XSS) vulnerability via the donor name, likely a stored XSS due to improper input sanitization. Impact is web-based contexts where donor fields can in...
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
PT-2019-14046 · Givewp +2 · Givewp +1
Name of the Vulnerable Software and Affected Versions: give plugin versions prior to 2.4.7 Description: The issue allows for XSS via a donor name. Recommendations: For versions prior to 2.4.7, update to version 2.4.7 or later to resolve the issue...
