CVE-2025-2331mediumCWE-200

CVE-2025-2331: fallo de gravedad media en stellarwp GiveWP – Donation Plugin and…

GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear GiveWP – Donation Plugin and Fundraising Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.22.1 via a misconfigured capability check in the 'permissionsCheck' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including reports detailing donors and donation amounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
stellarwp · GiveWP – Donation Plugin and Fundraising Platform
CVEs relacionadas — stellarwp GiveWP – Donation Plugin and…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-5932CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 76.8%CVE-2024-8353CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object InjectionEPSS 32.6%CVE-2025-0912CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object InjectionEPSS 1.4%CVE-2024-9634CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code ExecutionEPSS 1.4%CVE-2024-12877CRITICALGiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object InjectionEPSS 1.2%CVE-2022-2117MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information DisclosureEPSS 1.2%