CVE-2025-11227
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This allows unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Risk Assessment
Sensitive data leakage, such as donation form and campaign data, could compromise user privacy or organizational confidentiality.
Recommendation
Update the GiveWP plugin to the latest patched version and restrict access to data retrieval functions.
Other vulnerabilities in GiveWP
See all- CVE-2026-96333High
Authentication bypass by spoofing vulnerability in the GiveWP plugin. Affects versions from n/a through 4.16.8.1.
- CVE-2026-106600Medium
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.
- CVE-2026-97066Medium
Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.
- CVE-2026-96834Medium
Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.
- CVE-2026-96830High
GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.
- CVE-2026-5510Medium
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to and including 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-65464Medium
The GiveWP plugin version 4.16.3 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.
- CVE-2026-97196Critical
Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.
- CVE-2026-82222Critical
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.
- CVE-2026-104672High
Unauthenticated Cross Site Scripting (XSS) vulnerability in GiveWP up to version 4.17.0 allows an unauthenticated attacker to inject malicious scripts into pages viewed by other users.
Original NVD description (English source)
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS