Vulnerability feed

Executive summary

The GiveWP WordPress plugin, a donation management plugin, contains a flaw that lets users with donor-report view access change donor address information without authorization. The advisory rates the severity as low, with a CVSS score of 2.7, and the fix is version 4.19.0.1.

Technical summary

The flaw is a missing capability check (CWE-862, broken access control) in GiveWP's handling of donor address changes, so an authenticated user who holds donor-report view permission can modify donor addresses. The advisory describes the affected range as versions before 4.19.0.1 and the fixed version as 4.19.0.1. The CVSS score given is 2.7 (low). Attack vector details beyond the required donor-report view role, workarounds, and detection guidance are not stated. Exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/9fae25ff-51e6-…37-83d6-e752374dae57

Score

No CVSS score published.

Affects

GiveWPGiveWP

Executive summary

The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a custom fundraising role perform actions they should not be allowed to. The advisory rates it as medium severity with a CVSS score of 5.5. The fix is to update to version 4.19.0.1, which the advisory lists as the fixed version.

Technical summary

The flaw is an incorrect authorization issue (CWE-863) in which the plugin does not correctly determine which page a page-capability request applies to. Users with a custom fundraising role may be able to abuse this to gain access they should not have. The advisory states the fixed version is 4.19.0.1 and the affected versions are before 4.19.0.1. Attack vector and preconditions beyond the custom fundraising role are not stated. Workarounds are not stated. Detection guidance is not stated. The advisory text is truncated, so the full impact description is not available.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/7664c532-7a74-…de-8ae1-df4862067689

Score

No CVSS score published.

Affects

GiveWPGiveWP

Executive summary

A cross-site scripting flaw in the GiveWP WordPress donation plugin lets a malicious user inject script through a donation form template setting. The advisory rates it medium severity, with a CVSS score of 6.8, and says the fix is in version 4.19.0.1.

Technical summary

The flaw is a stored or reflected cross-site scripting (CWE-79) caused by GiveWP not properly sanitising and escaping one donation form template setting before it is output inside an HTML attribute. The advisory lists the affected versions as before 4.19.0.1 and the fixed version as 4.19.0.1. The attack vector, required privileges, and user interaction are not stated in the text provided. No workaround is stated. No detection guidance is stated. The advisory text is truncated and the remaining unrelated entries in the listing describe other plugins.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/59b1b0ff-fbfb-…b8-883e-94b5f2cee5a4

Score

No CVSS score published.

Affects

GiveWPGiveWP

Executive summary

The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a high-privilege custom role read files they should not be able to access. The advisory rates it medium severity with a CVSS score of 6.0, and it says the issue is fixed in version 4.19.0.1.

Technical summary

The flaw is a path traversal weakness (CWE-22, classified as TRAVERSAL) in which the plugin does not properly validate a user-supplied filename before reading it from disk. The attacker must hold a high-privilege custom role, so authentication is required. The advisory states the fix is in version 4.19.0.1 and that the affected versions are before 4.19.0.1. No workaround is stated, and no detection guidance is stated. The advisory also lists several unrelated plugin advisories with dates and titles, which are not clearly tied to this CVE, and exploitation in the wild is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/ab77a13e-491e-…a9-a50d-839a8ad341aa

Score

No CVSS score published.

Affects

GiveWPGiveWP

Executive summary

The GiveWP WordPress plugin is affected by a flaw that can expose sensitive information on public donation form pages. The advisory rates it medium severity with a CVSS score of 5.3, and the fix is to update to version 4.19.0.1.

Technical summary

The flaw is classified as sensitive data disclosure (CWE-200). The GiveWP plugin does not perform any status or capability check when rendering a donation form on a public front-end route, which allows information exposure to unauthenticated visitors; the advisory text is truncated, so the full impact is not stated. The advisory says the plugin is fixed in version 4.19.0.1 and that earlier versions are affected (before 4.19.0.1). The advisory does not state a workaround, whether exploitation in the wild has been observed, or any detection guidance. The listed related titles refer to other plugins and are not part of this GiveWP flaw.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from wpscan.com/vulnerability/f304401f-886c-…06-9629-d8f7a7146b78

Score

No CVSS score published.

Affects

GiveWPGiveWP