Unknown Givewp vulnerabilities

5 CVEs affecting Unknown Givewp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85113, published 2026-09-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14319, published 2026-07-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information…
CVE-2026-14318, published 2026-07-30. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject…
CVE-2026-85530, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing…
CVE-2026-85113, published 2026-09-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated…
CVE-2026-14317, published 2026-07-31. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows…