CVE-2024-11921

The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11921 Give < 3.19.0 - Reflected XSS

The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11921 Give < 3.19.0 - Reflected XSS

The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-11921

CVE-2024-11921 refers to the GiveWP WordPress plugin (versions prior to 3.19.0) and describes a Reflected Cross-Site Scripting vulnerability in which a parameter is not properly sanitised/escaped before being echoed on the page. This could enable an attacker to inject JavaScript when an admin or ...

PT-2024-17347

Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 3.19.0 Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting error,...

CVE-2024-9634

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the givecompanyname parameter. This makes it possible for unauthenticated attackers to inject a...

CVE-2024-9634 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of untrusted input from the givecompanyname parameter. This makes it possible for unauthenticated attackers to inject a...

PT-2024-39731 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.16.3 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and...

WordPress plugin WPExperts Square For GiveWP 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in...

WordPress GiveWP plugin <= 3.16.1 - Unauthenticated PHP Object Injection to Remote Code Execution (RCE) vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution RCE vulnerability discovered by cuokon in WordPress Plugin GiveWP versions = 3.16.1...

CVE-2024-8353

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...

WordPress plugin GiveWP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-38967

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to and including 3.16.1 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection due to the deserialization of...

CVE-2024-9130

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2024-9130

The CVE-2024-9130 entry cites a time-based SQL Injection in GiveWP – Donation Plugin and Fundraising Platform for WordPress, affecting all versions up to 3.16.1. The root cause is insufficient escaping of the order parameter and inadequate query preparation, allowing authenticated attackers (Give...

WordPress GiveWP plugin <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter vulnerability

Authenticated GiveWP Manager+ SQL Injection via order Parameter vulnerability discovered by Leo in WordPress Plugin GiveWP versions = 3.16.1...

WordPress WPExperts Square For GiveWP plugin <= 1.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jorge Diaz Patchstack Alliance in WordPress Plugin WPExperts Square For GiveWP versions = 1.3...

PT-2024-32527 · Givewp · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP versions prior to 3.15.2 Description: A Cross-Site Request Forgery CSRF issue affects GiveWP, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations: For versions prior to 3.15.2,...

The vulnerability of the GiveWP plugin of the WordPress content management system, related to deserialization mechanism flaws, allows attackers to execute arbitrary code.

The vulnerability of the GiveWP plugin in the WordPress content management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the givetitle parameter...

CVE-2024-5941

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers,...