CVE-2026-104672

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GiveWP: from n/a through 4.18.0.

Insecure Direct Object References (IDOR) vulnerability in GiveWP up to version 4.16.9. An unauthenticated user can access objects without logging in.

Sensitive Data Exposure vulnerability in GiveWP up to version 4.16.9. A subscriber can access sensitive data.

GiveWP plugin in versions up to and including 4.16.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. The lack of required authentication significantly increases the exploitation risk.

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to and including 4.14.4. This is due to insufficient input sanitization and output escaping on the continue_button_title and display_style shortcode attributes, which are passed through sanitize_text_field() but not properly escaped when output in HTML data attributes. This allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts that execute when a user accesses an injected page.

The GiveWP plugin version 4.16.3 and earlier is vulnerable to unauthenticated Cross Site Request Forgery (CSRF). An attacker can trick an administrator into performing unwanted actions.

Improper Validation of Unsafe Equivalence in Input vulnerability in GiveWP by Liquid Web / StellarWP allows Authentication Bypass. The issue affects GiveWP from n/a through 4.16.9.

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP from n/a through 4.16.7.1.

GiveWP plugin in versions up to and including 4.17.0 contains a Privilege Escalation vulnerability exploitable by an unauthenticated attacker.

Stored XSS vulnerability in GiveWP plugin up to version 4.17.0. Allows injection of a persistent script that can execute in the administrator's browser.