Exposição de GiveWP
Fundraising & donations, WordPress plugins89
score de exposição
6.151
sites usam
0
em exploração
5
críticos
Análise Vexday
O plugin GiveWP acumula 20 CVEs catalogadas, sem nenhuma entrada no catálogo KEV da CISA, o que coloca sua taxa de exploração ativa abaixo da média geral do catálogo. Ainda assim, o conjunto inclui 3 vulnerabilidades de severidade crítica e 3 falhas surgidas nos últimos 90 dias, indicando atividade recente no perfil de risco da tecnologia. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), padrão que tende a ser explorado em ataques de injeção de conteúdo contra usuários finais. A CVE mais perigosa ativa no momento é CVE-2023-0224, com EPSS de 0,037, sugerindo probabilidade de exploração ainda moderada, mas que merece atenção em ambientes onde o plugin está exposto publicamente.
CVEs
49 resultadosCVE-2026-85113MEDIUMGiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor NameEPSS 0.3%CVE-2025-66533MEDIUMWordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerabilityEPSS 0.3%CVE-2026-14317MEDIUMGiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction BypassEPSS 0.3%CVE-2026-73349MEDIUMWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-111978MEDIUMGiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings ImportEPSS 0.3%CVE-2026-104405HIGHWordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2026-96333HIGHWordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerabilityEPSS 0.3%CVE-2026-73352MEDIUMWordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-73348MEDIUMWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-66690HIGHWordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65441HIGHWordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-111979MEDIUMGiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary ColorEPSS 0.2%CVE-2026-97066MEDIUMWordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2026-73357MEDIUMWordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-47315MEDIUMWordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-116853MEDIUMWordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-42678HIGHWordPress GiveWP plugin <= 4.14.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111976MEDIUMGiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View RouteEPSS 0.2%CVE-2026-96830HIGHWordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-111974MEDIUMGiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via CurrencyEPSS 0.2%