PatchTheCVEgivewp vulnerabilities and fixes
Recent CVEs affecting givewp, with upgrade or downgrade steps. 5 tracked.
givewp has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-10-25. Highest priority: CVE-2026-111981 (score 1/100).
- CVE-2026-111981 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address c
- CVE-2026-111980 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request
- CVE-2026-111979 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form te
- CVE-2026-111978 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before readin
- CVE-2026-111976 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a
FAQ
How do I fix givewp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is givewp being exploited right now?
None of the tracked givewp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which givewp CVE should I patch first?
CVE-2026-111981 currently ranks highest (1/100): The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address c.