CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73349 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73349

CVE-2026-73349 applies to the WordPress GiveWP plugin, pre-4.16.6. It is an unauthenticated broken access control vulnerability reported for GiveWP before version 4.16.6. The provided CVSSv3.1 metrics indicate network access, low attack complexity, no privileges required, with no confidentiality ...

EUVD-2026-57912

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

PT-2026-71602

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

PT-2026-71604

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

CVE-2026-66690

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66690

The following CVE pertains to the WordPress GiveWP plugin: Unauthenticated Cross Site Scripting (XSS) in GiveWP versions

CVE-2026-66690

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-14317

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

CVE-2026-14319

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...

WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin GiveWP versions = 4.16.5...

CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...

CVE-2026-14317

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

CVE-2026-14317

CVE-2026-14317 : The GiveWP WordPress plugin is vulnerable in versions before 4.16.3. It does not restrict the set of available payment gateways to those enabled by the administrator and derives this from request input, allowing unauthenticated users to complete donations via a payment gateway th...

CVE-2026-14319

The CVE-2026-14319 entry concerns the GiveWP WordPress plugin prior to version 4.16.3. A REST API endpoint does not properly restrict access, allowing unauthenticated users to retrieve recurring-donation records, including names and subscription details of anonymous donors. Root cause is insuffic...

CVE-2026-14317 GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...