IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
5.3Medium

CVE-2025-2331GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure

stellarwp GiveWP – Donation Plugin and Fundraising Platform Published: (1 year ago)

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.

Weakness (CWE): CWE-200

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
givewp givewp < 3.22.2
stellarwp GiveWP – Donation Plugin and Fundraising Platform ≤ 3.22.1

References and patches

CPE matches (NVD) (1)
  • cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:* < 3.22.2

Recent CVEs in the same product — WordPress plugins & themes

7.2High
CVE-2026-120687

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

9.8Critical
CVE-2026-19907

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…