CVE-2026-11981: Stellarwp Givewp – Donation Plugin And Fundraising Platform

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

• Stellarwp Givewp – Donation Plugin And Fundraising Platform: up to and including 4.15.3

Published 2026-07-01. Last modified 2026-07-01.