PT-2024-32552 · Wpexperts · Wpexperts Square For Givewp

Name of the Vulnerable Software and Affected Versions: WPExperts Square For GiveWP versions 1.3 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

WordPress GiveWP Donation Fundraising Platform 3.14.1 Code Injection

============================================================================================================================================= | Title : WordPress GiveWP Donation Fundraising Platform 3.14.1 php code injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro /...

Exploit for Deserialization of Untrusted Data in Givewp

This post is a research article published by EQSTLabhttps://g...

WordPress GiveWP plugin <= 3.16.1 - Unauthenticated PHP Object Injection to Remote Code Execution (RCE) vulnerability

Unauthenticated PHP Object Injection to Remote Code Execution RCE vulnerability discovered by cuokon in WordPress Plugin GiveWP versions = 3.16.1...

WordPress GiveWP Plugin <= 3.16.2 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.2 Fixed in 3.16.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-8353 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID ab27727ec281 Credits cuokon Required privilege Unauthenticated...

CVE-2024-8353

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...

CVE-2024-8353

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...

CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...

CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'givetitle' and 'cardaddress'. This makes it possible for unauthenticate...

CVE-2024-8353

The CVE-2024-8353 entry documents a PHP Object Injection in the GiveWP WordPress plugin up to version 3.16.1, exploitable via deserialization of untrusted input (examples: give_title, card_address). A POP chain can enable arbitrary file deletion and remote code execution. This is aligned with CVE...

WordPress plugin GiveWP 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue...

PT-2024-38967

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to and including 3.16.1 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection due to the deserialization of...

CVE-2024-9130

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2024-9130

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2024-9130

The CVE-2024-9130 entry cites a time-based SQL Injection in GiveWP – Donation Plugin and Fundraising Platform for WordPress, affecting all versions up to 3.16.1. The root cause is insufficient escaping of the order parameter and inadequate query preparation, allowing authenticated attackers (Give...

CVE-2024-9130 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2024-9130 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

WordPress GiveWP plugin <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter vulnerability

Authenticated GiveWP Manager+ SQL Injection via order Parameter vulnerability discovered by Leo in WordPress Plugin GiveWP versions = 3.16.1...

WordPress GiveWP Plugin <= 3.16.1 is vulnerable to SQL Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.1 Fixed in 3.16.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-9130 Patch priority Low CVSS severity Low 7.6 Developer Liquid Web / StellarWP PSID ace2edd5d5b2 Credits Leo Required privilege GiveWP Manager Published 27...

WordPress plugin GiveWP SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...