CVE-2025-22777criticalCWE-502

CVE-2025-22777: critical vulnerability in StellarWP GiveWP

WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability

Published · Updated

Follow this CVE+ Monitor GiveWP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 0.9%
In short

The GiveWP WordPress plugin has a flaw that allows attackers to inject malicious code by sending specially crafted data. If exploited, an attacker could take control of the website or steal sensitive information.

Technical detail

A PHP object deserialization vulnerability (CWE-502) in GiveWP <= 3.19.3 permits unauthenticated object injection through untrusted serialized data. An attacker can craft malicious serialized objects to trigger arbitrary code execution or access sensitive functionality without requiring authentication or user interaction.

Summary generated and translated by AI from the official description.
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
StellarWP · GiveWP
Related CVEs — StellarWP GiveWP

In the same product, most dangerous first.

CVE-2024-30229HIGHWordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2023-47183MEDIUMWordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-27987HIGHWordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-35679HIGHWordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47315MEDIUMWordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-42642MEDIUMWordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerabilityEPSS 0.2%