These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site. This vulnerability allows unauthorized modifications to donor addresses, potentially leading to data integrity issues and unauthor [truncated]
The GiveWP WordPress plugin before 4.19.0.1 has a vulnerability allowing users with a custom fundraising role to edit, publish, and read pages owned by other users, including administrators. This issue arises from the plugin's incorrect determination of which page a page-capability request applies to. As a result, users with custom fundraising roles may have elevated privileges, potentially leading to una [truncated]
The GiveWP WordPress plugin before 4.19.0.1 has a vulnerability allowing users with a custom form-editing role to inject arbitrary web scripts. This issue arises from improper sanitization and escaping of donation form template settings, potentially leading to XSS attacks on visitors or administrators viewing the affected donation form. The vulnerability can be exploited by users with custom form-editing [truncated]
The GiveWP WordPress plugin before 4.19.0.1 allows unauthenticated visitors to view unpublished donation forms on public front-end routes due to missing status and capability checks. This issue arises from a lack of status and capability checks when rendering donation forms, potentially exposing sensitive information and settings of unpublished donation forms. WordPress site administrators should assess t [truncated]
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages. This oversight allows unauthenticated users to execute arbitrary shortcodes registered on the site by nesting shortcodes, potentially leading to unauthorized actions and data breaches. Defenders should assess the vulnerability's impact on their WordPress sites an [truncated]
The GiveWP WordPress plugin before 4.16.3 has a vulnerability allowing unauthenticated users to retrieve information about anonymous recurring donors via a REST API endpoint. This issue has a CVSS score of 7.5 and is considered HIGH severity. The vulnerability impacts organizations using the GiveWP WordPress plugin, particularly those with anonymous recurring donors. Affected deployments should be identif [truncated]