Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-96333 | 7.5 high | 0.00% | no CPE yet | Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1. | 9 Oct |
| CVE-2026-34900 | 7.1 high | 0.00% | no CPE yet | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. | Sun 25 Oct |
| CVE-2026-66690 | 7.1 high | 0.00% | no CPE yet | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | Sat 24 Oct |
| CVE-2026-65441 | 7.1 high | 0.00% | no CPE yet | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | Sat 24 Oct |
| CVE-2026-111979 | 6.8 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form. | Mon 26 Oct |
| CVE-2026-73348 | 6.5 medium | 0.00% | no CPE yet | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | Fri 23 Oct |
| CVE-2026-73357 | 6.5 medium | 0.00% | no CPE yet | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | Fri 23 Oct |
| CVE-2026-73352 | 6.5 medium | 0.00% | no CPE yet | Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | Thu 22 Oct |
| CVE-2025-66533 | 6.5 medium | 0.00% | no CPE yet | Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1. | 22 Oct |
| CVE-2025-11227 | 6.5 medium | 0.00% | givewp | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns. | 11 Oct |
| CVE-2026-97643 | 6.4 medium | 0.00% | no CPE yet | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `givewp_campaign_grid` shortcode in versions up to, and including, 4.17.0 This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes (`filter_by`, `layout`, `sort_by`, `order_by`) in the CampaignGridShortcode::parseAttributes() function combined with the render template emitting `json_encode($attributes)` inside a single-quoted HTML attribute without esc_attr() — json_encode() does not escape single quotes by default, so a `'` in an attribute value breaks out of the enclosing attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | 13 Oct |
| CVE-2025-13206 | 6.1 medium | 0.00% | givewp | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Avatars must be enabled in the WordPress install in order to exploit the vulnerability. | 18 Oct |
| CVE-2026-111978 | 6.0 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration. | Mon 26 Oct |
| CVE-2026-111980 | 5.5 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators. | Mon 26 Oct |
| CVE-2026-65464 | 5.4 medium | 0.00% | no CPE yet | Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions. | Sat 24 Oct |
| CVE-2026-111974 | 5.3 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount. | Mon 26 Oct |
| CVE-2026-111976 | 5.3 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public. | Mon 26 Oct |
| CVE-2026-42642 | 5.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5. | Mon 26 Oct |
| CVE-2026-73349 | 5.3 medium | 0.00% | no CPE yet | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | Fri 23 Oct |
| CVE-2025-11228 | 5.3 medium | 0.00% | givewp | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign. | 11 Oct |
| CVE-2026-106600 | 5.3 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0. | 8 Oct |
| CVE-2026-111981 | 2.7 low | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site. | Mon 26 Oct |
22 of 22
Download these 22 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.