Exposição de GiveWP
Fundraising & donations, WordPress plugins61
score de exposição
6.349
sites usam
0
em exploração
4
críticos
Análise Vexday
O plugin GiveWP acumula 20 CVEs catalogadas, sem nenhuma entrada no catálogo KEV da CISA, o que coloca sua taxa de exploração ativa abaixo da média geral do catálogo. Ainda assim, o conjunto inclui 3 vulnerabilidades de severidade crítica e 3 falhas surgidas nos últimos 90 dias, indicando atividade recente no perfil de risco da tecnologia. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tende a ser explorado em ataques de injeção de conteúdo contra usuários finais. A CVE mais perigosa ativa no momento é CVE-2023-0224, com EPSS de 0,037, sugerindo probabilidade de exploração ainda moderada, mas que merece atenção em ambientes onde o plugin está exposto publicamente.
CVEs
32 resultadosCVE-2023-0224CRITICALGiveWP < 2.24.1 - Unauthenticated SQLiEPSS 3.7%CVE-2026-82222CRITICALWordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerabilityEPSS 1.5%CVE-2025-22777CRITICALWordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilityEPSS 0.9%CVE-2024-11921MEDIUMGive < 3.19.0 - Reflected XSSEPSS 0.8%CVE-2023-41665HIGHWordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerabilityEPSS 0.8%CVE-2023-22719MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV InjectionEPSS 0.6%CVE-2024-30229HIGHWordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerabilityEPSS 0.6%CVE-2024-37099CRITICALWordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerabilityEPSS 0.6%CVE-2022-4448MEDIUMGiveWP < 2.24.0 - Contributor+ Stored XSSEPSS 0.6%CVE-2022-40211MEDIUMWordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerabilityEPSS 0.4%CVE-2023-47183MEDIUMWordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-23672MEDIUMWordPress GiveWP plugin <= 2.25.1 - Arbitrary Content Deletion vulnerabilityEPSS 0.4%CVE-2023-23668MEDIUMWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-85530HIGHGiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization MismatchEPSS 0.4%CVE-2024-27987HIGHWordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-35679HIGHWordPress GiveWP plugin <= 3.12.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14319HIGHGiveWP < 4.16.3 - Unauthenticated Recurring Donor Information DisclosureEPSS 0.3%CVE-2026-14318MEDIUMGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsEPSS 0.3%CVE-2025-66533MEDIUMWordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerabilityEPSS 0.3%CVE-2026-73352MEDIUMWordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerabilityEPSS 0.2%