Veille CVE

Recherche « Unknown GiveWP »

5 CVE

Critique 0 Élevée 2 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown GiveWP » ✕
  1. CVE-2026-85113 6.5 Moyenne

    Unknown GiveWP

    The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

  2. CVE-2026-85530 8.1 Élevée

    Unknown GiveWP

    The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.

  3. CVE-2026-14319 7.5 Élevée

    Unknown GiveWP

    The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

  4. CVE-2026-14317 5.3 Moyenne

    Unknown GiveWP

    The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled.

  5. CVE-2026-14318 6.8 Moyenne

    Unknown GiveWP

    The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor.