GiveWP – Donation Plugin and Fundraising Platform

Explore GiveWP – Donation Plugin and Fundraising Platform vulnerabilities across all versions. Currently tracking 78 known vulnerabilities, including severity, impact, and patch status.

01234567891007.04.2015Today20.04.20156.1GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting CVSS 6.1 · 20.04.201505.02.20196.1GiveWP <= 2.3.0 - Cross-Site Scripting CVSS 6.1 · 05.02.201915.05.20195.4GiveWP <= 2.4.6 - Cross-Site Scripting CVSS 5.4 · 15.05.201912.08.20199.8GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection CVSS 9.8 · 12.08.201926.09.20197.5GiveWP <= 2.5.4 - Authorization Bypass CVSS 7.5 · 26.09.201930.10.20195.3GiveWP <= 2.5.9 - Missing Authorization to Settings Update CVSS 5.3 · 30.10.201923.03.20216.1GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting CVSS 6.1 · 23.03.202130.04.20214.8GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 30.04.202126.07.20214.8GiveWP <= 2.11.3 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 26.07.202118.01.20224.8GiveWP <= 2.17.2 - Reflected Cross-Site Scripting via Import Tool CVSS 4.8 · 18.01.20226.1GiveWP <= 2.17.2 - Reflected Cross-Site Scripting CVSS 6.1 · 18.01.20226.1GiveWP <= 2.17.2 - Reflected Cross-Site Scripting CVSS 6.1 · 18.01.202217.06.20225.3GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure CVSS 5.3 · 17.06.202208.07.20224.3GiveWP – Donation Plugin and Fundraising Platform <= 2.21.2 - Cross-Site Request Forgery CVSS 4.3 · 08.07.202211.07.20225.5GiveWP <= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 11.07.202212.07.20225.5GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation CVSS 5.5 · 12.07.20224.9GiveWP <= 2.20.2 - Authenticated Arbitrary File Read CVSS 4.9 · 12.07.202219.01.20239.8GiveWP <= 2.23.2 - Unauthenticated SQL Injection CVSS 9.8 · 19.01.20236.4GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 19.01.202308.03.20234.3GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush CVSS 4.3 · 08.03.20236.1GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown CVSS 6.1 · 08.03.20238.3GiveWP <= 2.25.1 - Unauthenticated CSV Injection CVSS 8.3 · 08.03.20234.3GiveWP <= 2.25.1 - Cross-Site Request Forgery via save CVSS 4.3 · 08.03.20235.4GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action CVSS 5.4 · 08.03.20234.1GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler CVSS 4.1 · 08.03.20236.4GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode CVSS 6.4 · 08.03.202310.03.20235.4GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion CVSS 5.4 · 10.03.20236.4GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 10.03.202323.03.20235.3GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note CVSS 5.3 · 23.03.20235.3GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note CVSS 5.3 · 23.03.20234.3GiveWP <= 2.25.2 - Cross-Site Request Forgery CVSS 4.3 · 23.03.202310.05.20236.6GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection CVSS 6.6 · 10.05.202331.08.20237.2Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation CVSS 7.2 · 31.08.202331.10.20235.3GiveWP <= 2.33.1 - Missing Authorization via handleBeforeGateway CVSS 5.3 · 31.10.20235.4GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation CVSS 5.4 · 31.10.20235.4GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion CVSS 5.4 · 31.10.20234.3GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation CVSS 4.3 · 31.10.202319.01.20246.4GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 19.01.202415.03.20246.1GiveWP <= 3.3.1 - Reflected Cross-Site Scripting CVSS 6.1 · 15.03.202419.03.20246.4GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 19.03.202412.04.20246.4GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 12.04.202426.04.20248.8GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection CVSS 8.8 · 26.04.202417.05.20246.4GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 17.05.202406.06.20246.1GiveWP – Donation Plugin and Fundraising Platform <= 3.12.0 - Reflected Cross-Site Scripting CVSS 6.1 · 06.06.202418.07.20245.4GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions CVSS 5.4 · 18.07.202409.08.20248.1GiveWP <= 3.14.1 - Unauthenticated PHP Object Injection CVSS 8.1 · 09.08.202419.08.20245.3GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure CVSS 5.3 · 19.08.20246.5GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update CVSS 6.5 · 19.08.20245.4GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion CVSS 5.4 · 19.08.202410.0GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution CVSS 10.0 · 19.08.202428.08.20245.3GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure CVSS 5.3 · 28.08.202425.09.20244.3GiveWP <= 3.15.1 - Cross-Site Request Forgery CVSS 4.3 · 25.09.202426.09.20247.2GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter CVSS 7.2 · 26.09.202427.09.20249.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection CVSS 9.8 · 27.09.202415.10.20249.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution CVSS 9.8 · 15.10.202406.12.20246.1GiveWP – Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting CVSS 6.1 · 06.12.202410.01.20259.8GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection CVSS 9.8 · 10.01.20259.8GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection CVSS 9.8 · 10.01.202503.03.20259.8GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection CVSS 9.8 · 03.03.202514.03.20256.5Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function CVSS 6.5 · 14.03.202521.03.20255.3GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure CVSS 5.3 · 21.03.202518.06.20255.4GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification CVSS 5.4 · 18.06.202530.07.20255.4GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting CVSS 5.4 · 30.07.202505.08.20255.3GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure CVSS 5.3 · 05.08.202520.08.20254.3GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update CVSS 4.3 · 20.08.202503.10.20255.3GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association CVSS 5.3 · 03.10.20256.5GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure CVSS 6.5 · 03.10.202518.11.20257.2GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' CVSS 7.2 · 18.11.202523.12.20254.3GiveWP <= 4.13.1 - Cross-Site Request Forgery CVSS 4.3 · 23.12.202508.01.20266.5GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 08.01.202602.03.20265.3GiveWP <= 4.14.5 - Missing Authorization CVSS 5.3 · 02.03.202621.04.20266.1GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting CVSS 6.1 · 21.04.202616.05.20267.2GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 16.05.202630.06.20266.4GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute CVSS 6.4 · 30.06.20264.3GiveWP <= 4.15.3 - Cross-Site Request Forgery CVSS 4.3 · 30.06.202601.07.20266.4GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form CVSS 6.4 · 01.07.202615.07.20266.4GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting CVSS 6.4 · 15.07.202622.07.20264.3GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery CVSS 4.3 · 22.07.2026

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

78

Get automatic notifications for all GiveWP – Donation Plugin and Fundraising Platform vulnerabilities before they are exploited.

Vulnerability Records

78 records
2026-07-22 00:00CVE-2026-65464
4.3
Medium
jh_hackYes
2026-07-15 13:43CVE-2026-14987
6.4
Medium
FeDEXYes
2026-07-01 17:15CVE-2026-13704
6.4
Medium
Chirita Catalin-Andrei (CC99IE)Yes
2026-06-30 16:29CVE-2026-11981
4.3
Medium
javitoiaYes
2026-06-30 14:48CVE-2026-13246
6.4
Medium
AmonRaYes
2026-05-16 00:00CVE-2026-42678
7.2
High
thevietroninYes
2026-04-21 00:00CVE-2026-34900
6.1
Medium
HuajiHDYes
2026-03-02 00:00CVE-2026-42642
5.3
Medium
Bao - BlueRockYes
2026-01-08 00:00CVE-2025-66533
6.5
Medium
Kishan VyasYes
2025-12-23 00:00CVE-2025-67467
4.3
Medium
Drew Webber (mcdruid)Yes
Showing 1–10 of 78 reports
GiveWP &#8211; Donation Plugin and Fundraising Platform banner
Latestv4.16.5.1

GiveWP &#8211; Donation Plugin and Fundraising Platform

Nexcess

Author

Nexcess

4.6(705)
92/100
Last Updated
2026-07-27 (2d ago)
Active Installs
100,000+
Downloads
11,903,137
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2015-04-07 (12y ago)

GiveWP is the highest rated, most downloaded, and best supported donation plugin for WordPress. Whether you need a simple donate button or a powerful donation platform optimized for online giving, GiveWP is right for you. Transform the way you accept online donations, starting for free. With GiveWP you can accept gifts for charity or for other purposes, through customizable donation forms. Our donation plugin also allows you to view donor data and fundraising reports, manage donors, and integrate with a wide variety of third-party gateways and services. ✨ GiveWP Features GiveWP is free and full of many advanced features to suit your needs. Start by choosing one of our donation form templates to create your first fundraising campaign. Then, take advantage of full-featured fundraising reports and donor management tools to increase your overall fundraising revenue by learning what makes donors donate. Free donor tools also help keep your donors happy. The donor dashboard helps your donor base easily manage their accounts and access their donation history. With our premium add-ons, you can add additional donor tools, like annual receipts. Campaign-Based Fundraising and Forms GiveWP makes it easy to manage and launch successful fundraising campaigns directly from your WordPress site. Whether you’re raising funds for a single project, a long-term cause, or a series of initiatives, GiveWP’s campaign-based approach helps you streamline your efforts and maximize your fundraising potential. Key Features of Campaign-Based Fundraising Campaign Creation: Create multiple campaigns on your site, each with its own unique donation goal, target audience, and messaging. Customizable Donation Forms: Each campaign comes with a built-in, fully customizable landing page, created using the WordPress Block Editor. Add text, images, and donation forms to create a visually appealing and engaging page that strengthens your donor connections. Dedicated Landing Pages: Create custom landing pages for each campaign, complete with campaign-specific content, donation forms, progress bars, and social sharing options to engage and inspire donors. Organized Fundraising: All your donation forms are linked to specific campaigns. This makes it easy to manage and track your efforts, set goals, and monitor campaign performance in one streamlined view. Visibility Controls: Publish, archive, or draft campaigns to manage when and how your campaigns appear on your site. This gives you full control over the visibility of your campaigns and associated donation forms. How Campaigns and Donation Forms Work Together GiveWP’s donation forms seamlessly integrate with your campaigns, allowing you to: Create forms that directly support the campaign’s fundraising goals. Customize form fields to match the needs of your campaign, whether it’s a specific project or a general cause. Promote campaigns via donation forms displayed on any page on your website. Campaigns offer more flexibility, better control, and enhanced organization for your fundraising efforts, making it easier to achieve your goals and connect with donors. Whether you’re running a large-scale initiative or multiple smaller projects, Campaigns will help you streamline the process and improve your overall fundraising strategy. Never used blocks before? No worries – we’ve got you covered with our guide. Actionable Fundraising Reporting Get a detailed breakdown of your donation activity Control your fundraising data with exports and reports Filter reports by date, form, and payment method Measure performance across multiple campaigns Complete Donor Management View a complete history of your donor activity Generate tax-deductible receipts Allow donors to view their donation history, update their profile, manage their recurring donations, and download PDF receipts through their own donor dashboard Find out more: Visit the GiveWP website Read our Docs on How to Use the Visual Form Builder. View GiveWP Premium Add-ons View GiveWP Free Add-ons Book a Live Demo with our Team 🧑🏿‍🤝‍🧑🏿 Who Uses GiveWP? With more than 100,000+ active installs of GiveWP, we hear more and more success stories from nonprofit organizations. Causes are using GiveWP to raise millions of dollars per year. Check out some of our GiveWP Stories and Case Studies for details about their success. The City Mission used GiveWP for Giving Tuesday and a competition fundraiser with a neighboring organization, where they raised $45K in 16 hours. A local neighborhood watch program switched from using GoFundMe to GiveWP and raised $40,000 in five days for a memorial fundraiser. Fans of Ivan the Gorilla have kept his memory alive by fundraising for a conservancy program in his name. A hospital raised money through a community-wide virtual dance party during the pandemic. Quiltlove, which provides personalized quilts for different life events (like new babies, extended hospital stays, and more), uses GiveWP to create a sustainable business model. Niels Vink, a Dutch wheelchair tennis player, uses GiveWP to raise money to train, travel, and participate in competitions. At the 2021 Tokyo Paralympics, Vink earned a gold medal in doubles and a bronze medal in singles. In addition to nonprofit organizations, GiveWP is widely used for individual or creative purposes. We’ve seen tip jars for blogs or musicians, live streams, and more. Our Donation Upsells for WooCommerce Add-on is even used in some eCommerce stores to collect donations for a cause, or ask for tips in the cart or checkout. We’ve even seen GiveWP used to collect gifts for birthdays and weddings! 💝 Simple and Pain-Free Giving We built GiveWP to be the best WordPress donation plugin from day one. Simply install and activate the plugin to get started. The strength of GiveWP lies within its optimized donation forms. When creating a form, you can start with a template and customize the donation levels, including allowing donors to give a custom amount. The donation forms can then be displayed anywhere on your website using a block, shortcode, widget, or the single donation form page. You can also integrate your forms with a wide variety of payment processors, including PayPal and Stripe within the free plugin. You can also purchase add-ons to use Authorize,net, Bitpay, Square, and more. 🌱 First Time Users For new users, we suggest reviewing our Getting Started Guide to get an understanding of how the plugin works. If you run into any trouble, we offer free support to help you with your issues, questions, and concerns. If you are a GiveWP customer with an active license of any of our popular add-ons, we’d love to hear from you and support you via our Priority Support channel. 💳 Accept Credit Card Donations and More GiveWP comes with several payment gateway options: Stripe Donations — Accept donations through any payment method (like Apple Pay, Google Pay, or ACH) activated in your Stripe accounts. Additional fees may apply for free users. Read our Stripe documentation for more information. PayPal Donations — Allow worldwide donations with PayPal Donations. No additional fees applied. Venmo Donations — Give donors the option to pay through Venmo with their account balance or connected bank account. Offline Donations — Enable your donors to send checks or physical donations with an offline gateway with instructions. Test Gateway — use the Test Gateway to see exactly how your donors will walk through the donation process. And many more Gateways – View additional payment gateways on our website. These include Authorize.net, Bitpay, Square, Razorpay, Paytm, and more. In-Person Donations (Tap To Pay) — Accept swipe, insert, or Tap to Pay card donations right from your mobile device or Stripe reader with Jovvie. ⚙️ Extend GiveWP with Powerful Add-ons GiveWP’s goal is to “Democratize Generosity.” We want to make it easy for everyone to raise funds online. In addition to our free donation plugin, we have premium GiveWP add-ons available to extend the functionality of GiveWP. Ultimately, these tools allow you to raise more money and give you a better relationship with your donors. Must-Have Add-ons for GiveWP: WordPress Recurring Donations Peer-to-Peer Fundraising Text-to-Give Form Field Manager Fee Recovery Tributes PDF Receipts Funds & Designations View all of GiveWP’s Add-ons to discover all the ways you can further enhance and extend GiveWP. 🛠️ Easy to Customize and Enhance Are you a developer? GiveWP is built with best practices and easy to extend and customize. Here are some great developer-oriented tutorials and docs to help you customize GiveWP to your liking: Create Dramatic Donation Email Receipts Populate Donor Info with One Click Using the GiveWP API to Create Charts with ChartJS Theming with GiveWP How to Create Custom Form Fields in GiveWP How to Build a Gateway Add-on for GiveWP How to Style Your GiveWP Forms Site Redesigns Without Donation Data Loss Handling Custom CSS in WordPress 💚 About the GiveWP Team The most downloaded fundraising plugin on WordPress, Give has helped users raise over $350 million since 2009. Behind it is a professional team of WordPress developers who know what serious fundraising operations need: flexible tools, rock-solid reliability, and software that grows with your mission. As part of Nexcess’s software offerings, Give is backed by decades of experience building and hosting WordPress solutions. 📧 Connect with GiveWP Stay in touch with us for important plugin news and updates: GiveWP Website GiveWP Newsletter Facebook GiveWP Add-ons Write for GiveWP 🐱‍💻 Contribute to GiveWP This plugin is proudly open source (GPL license) and we’re always looking for more contributors. Whether you know another language, love to code, or just have an idea, we would love your help and input. Here’s a few ways you can contribute to GiveWP: Star/fork/watch the GiveWP GitHub repository to learn more about what issues we’re tackling and the project is developing. If you’ve never worked with Github before, learn about pull requests here and submit one for GiveWP, we’d love to give you our feedback. Translate GiveWP into your native language. The best place to do that is here on wordpress.org. Go to https://translate.wordpress.org/, then search for your language, click the “Plugins” tab, then search for “GiveWP”. When you’ve submitted at least 95% of GiveWP’s strings, the language moderators will review and approve your translations and then they will be available to all WordPress users for your native language. If you are interested in translating any of our Premium Add-ons, contact us, we’d love to chat with you about that. Join the GiveWP Community Facebook group. We chat about all things related to WordPress, GiveWP, fundraising, and online donations in general.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C