GiveWP is a WordPress donation and fundraising plugin that, despite a narrow product footprint, occupies a prominent position across thousands of nonprofit and charitable websites. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a moderate tendency toward public exploit availability. The exposure recurs persistently through web-application weakness classes including cross-site scripting, improper authorization and CSRF handling, unsafe deserialization, and information exposure—reflecting the plugin's role in processing donor data and financial transactions within the WordPress ecosystem. Defenders managing WordPress deployments that support fundraising operations should prioritize this vendor's security updates and conduct regular access-control audits on donation endpoints. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Givewp over time
Signals from CVEs in this vendor scope (61 CVEs).
61 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-5932CRITICAL The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of | Aug 20, 2024 | 9.8 | 86 | NO | YES |
CVE-2024-8353CRITICAL The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of | Sep 28, 2024 | 9.8 | 68 | NO | YES |
CVE-2025-2025HIGH The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnin | Mar 15, 2025 | 7.5 | 34 | NO | NO |
CVE-2025-0912CRITICAL The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted input from the Donatio | Mar 4, 2025 | 9.8 | 31 | NO | NO |
CVE-2024-9634CRITICAL The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.3 via deserialization of | Oct 16, 2024 | 9.8 | 31 | NO | NO |
CVE-2021-25099MEDIUM The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_ch | Feb 21, 2022 | 6.1 | 31 | NO | YES |
CVE-2023-0224CRITICAL The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks | Jan 16, 2024 | 9.8 | 30 | NO | NO |
CVE-2021-24213MEDIUM The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration pan | Apr 12, 2021 | 6.1 | 30 | NO | YES |
CVE-2019-13578CRITICAL A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to e | Aug 15, 2019 | 9.8 | 30 | NO | NO |
CVE-2025-22777CRITICAL Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3. | Jan 13, 2025 | 9.8 | 29 | NO | NO |
Signals from CVEs in this vendor scope (61 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Givewp.
Media articles that mention a CVE ID that affects a product developed by Givewp — matched by CVE ID, not by vendor name.