Givewp

Givewp

61 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2022-40312

  • EPSS 0.07%
  • Veröffentlicht 18.12.2023 15:15:08
  • Zuletzt bearbeitet 21.11.2024 07:21:17

Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.

9.8

CVE-2023-22719

  • EPSS 0.69%
  • Veröffentlicht 07.11.2023 16:15:28
  • Zuletzt bearbeitet 21.11.2024 07:45:17

Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

8.8

CVE-2023-25450

  • EPSS 0.05%
  • Veröffentlicht 15.06.2023 13:15:09
  • Zuletzt bearbeitet 21.11.2024 07:49:31

Cross-Site Request Forgery (CSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform plugin <= 2.25.1 versions.

5.4

CVE-2023-23668

  • EPSS 0.1%
  • Veröffentlicht 08.05.2023 12:15:09
  • Zuletzt bearbeitet 21.11.2024 07:46:37

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in GiveWP plugin <= 2.25.1 versions.

5.4

CVE-2022-4448

Exploit
  • EPSS 0.25%
  • Veröffentlicht 13.02.2023 15:15:16
  • Zuletzt bearbeitet 21.03.2025 15:15:38

The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform St...

6.5

CVE-2022-2260

Exploit
  • EPSS 0.16%
  • Veröffentlicht 01.08.2022 13:15:10
  • Zuletzt bearbeitet 21.11.2024 07:00:38

The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the...

4.8

CVE-2022-2215

Exploit
  • EPSS 0.22%
  • Veröffentlicht 01.08.2022 13:15:10
  • Zuletzt bearbeitet 21.11.2024 07:00:33

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallow...

4.9

CVE-2022-31475

  • EPSS 0.44%
  • Veröffentlicht 21.07.2022 18:15:08
  • Zuletzt bearbeitet 20.02.2025 21:15:20

Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

7.2

CVE-2022-28700

  • EPSS 4.79%
  • Veröffentlicht 21.07.2022 18:15:08
  • Zuletzt bearbeitet 20.02.2025 21:15:17

Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

5.3

CVE-2022-2117

  • EPSS 0.78%
  • Veröffentlicht 18.07.2022 17:15:09
  • Zuletzt bearbeitet 21.11.2024 07:00:20

The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is n...