Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: GiveWP 4.19.0.1 Clear all filters
TI-2026-80103 CVE-2026-111981 · GHSA-9wv6-rw6f-46c3

Missing authorization in GiveWP lets users alter donor addresses

Priority LOW 13

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modif…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00168 Published 2026-10-25 Fixed in 4.19.0.1 CWE-862
TI-2026-80102 CVE-2026-111980 · GHSA-7v79-ff47-vhhm

Incorrect authorization in GiveWP lets users edit other users' pages

Priority LOW 24

The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users…

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00179 Published 2026-10-25 Fixed in 4.19.0.1 CWE-863
TI-2026-80101 CVE-2026-111979 · GHSA-xm8r-m35h-qq8p

Stored cross-site scripting in GiveWP form template primary color

Priority LOW 32

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00235 Published 2026-10-25 Fixed in 4.19.0.1 CWE-79
TI-2026-80100 CVE-2026-111978 · GHSA-f89g-x83g-732v

Path traversal in GiveWP plugin exposes files and overwrites settings

Priority LOW 27

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the conten…

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00276 Published 2026-10-25 Fixed in 4.19.0.1 CWE-22
TI-2026-80099 CVE-2026-111976 · GHSA-9x4v-8r28-fx8w

Unauthenticated disclosure of unpublished GiveWP donation forms

Priority LOW 29

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings o…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00197 Published 2026-10-25 Fixed in 4.19.0.1 CWE-200