# StellarWP GiveWP vulnerabilities Source: https://junglewise.ai/threats/technologies/givewp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/givewp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in StellarWP GiveWP: 0 in the last 7 days and 7 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116853, was published on 30 October 2026. 1 vulnerability in the last four weeks, down 80% on the four before (5). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 7 - All time: 19 (2 critical, 0 exploited in the wild) ## About StellarWP GiveWP GiveWP is a WordPress plugin designed for accepting donations and managing fundraising directly on a website. ## Latest StellarWP GiveWP vulnerabilities - [CVE-2026-116853: GiveWP unauthenticated broken access control](https://junglewise.ai/threats/cve-2026-116853-unauthenticated-broken-access-control-in-givewp-4-19-0-1) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-96333: StellarWP GiveWP authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-96333-authentication-bypass-by-spoofing-vulnerability-in-liquid-web) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-104672: GiveWP cross-site scripting in core](https://junglewise.ai/threats/cve-2026-104672-unauthenticated-cross-site-scripting-xss-in-givewp-4-17-0) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-104405: GiveWP privilege escalation](https://junglewise.ai/threats/cve-2026-104405-unauthenticated-privilege-escalation-in-givewp-4-17-0-versions) (high, CVSS 8.1, published 6 Oct 2026) - [CVE-2026-104404: StellarWP GiveWP stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104404-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-97196: StellarWP GiveWP authentication bypass in login validation](https://junglewise.ai/threats/cve-2026-97196-improper-validation-of-unsafe-equivalence-in-input-vulnerability) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-82222: StellarWP GiveWP PHP object injection to RCE](https://junglewise.ai/threats/cve-2026-82222-stellarwp-givewp-php-object-injection-to-rce) (critical, CVSS 10, published 28 Aug 2026) - [CVE-2026-66690: GiveWP unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-66690-givewp-unauthenticated-cross-site-scripting) (high, CVSS 7.1, published 6 Aug 2026) - [CVE-2026-14319: GiveWP WordPress plugin information disclosure in REST API](https://junglewise.ai/threats/cve-2026-14319-givewp-wordpress-plugin-information-disclosure-in-rest-api) (info, CVSS 5.3, published 31 Jul 2026) - [CVE-2026-14317: GiveWP WordPress plugin payment gateway restriction bypass](https://junglewise.ai/threats/cve-2026-14317-givewp-wordpress-plugin-payment-gateway-restriction-bypass) (info, CVSS 5.3, published 31 Jul 2026) - [CVE-2026-14318: GiveWP Stored XSS in Donation Form Template Settings](https://junglewise.ai/threats/cve-2026-14318-givewp-stored-xss-in-donation-form-template-settings) (info, CVSS 6.8, published 30 Jul 2026) - [CVE-2026-65441: Nexcess GiveWP unauthenticated XSS](https://junglewise.ai/threats/cve-2026-65441-nexcess-givewp-unauthenticated-xss) (high, CVSS 7.1, published 27 Jul 2026) - [CVE-2026-65464: Nexcess GiveWP CSRF in WordPress plugin](https://junglewise.ai/threats/cve-2026-65464-nexcess-givewp-csrf-in-wordpress-plugin) (medium, CVSS 5.4, published 23 Jul 2026) - [CVE-2026-14987: StellarWP GiveWP Stored XSS in Sequoia Template Setting](https://junglewise.ai/threats/cve-2026-14987-stellarwp-givewp-stored-xss-in-sequoia-template-setting) (medium, CVSS 6.4, published 16 Jul 2026) - [CVE-2026-13704: StellarWP GiveWP Stored XSS in Sequoia template image parameter](https://junglewise.ai/threats/cve-2026-13704-stellarwp-givewp-stored-xss-in-sequoia-template-image-parameter) (medium, CVSS 6.4, published 2 Jul 2026) - [CVE-2026-13246: StellarWP GiveWP Stored XSS in givewp_campaign_comments shortcode](https://junglewise.ai/threats/cve-2026-13246-stellarwp-givewp-stored-xss-in-givewp-campaign-comments-shortcode) (medium, CVSS 6.4, published 1 Jul 2026) - [CVE-2026-11981: GiveWP CSRF in give_set_notification_status_handler](https://junglewise.ai/threats/cve-2026-11981-givewp-csrf-in-give-set-notification-status-handler) (medium, CVSS 4.3, published 1 Jul 2026) - [CVE-2026-34900: GiveWP unauthenticated reflected XSS](https://junglewise.ai/threats/cve-2026-34900-givewp-unauthenticated-reflected-xss) (high, CVSS 7.1, published 15 Jun 2026) - [CVE-2026-42678: Liquid Web GiveWP DOM-based XSS](https://junglewise.ai/threats/cve-2026-42678-liquid-web-givewp-dom-based-xss) (high, CVSS 7.1, published 1 Jun 2026) ## Most severe StellarWP GiveWP vulnerabilities - [CVE-2026-82222: StellarWP GiveWP PHP object injection to RCE](https://junglewise.ai/threats/cve-2026-82222-stellarwp-givewp-php-object-injection-to-rce) (critical, CVSS 10, published 28 Aug 2026) - [CVE-2026-97196: StellarWP GiveWP authentication bypass in login validation](https://junglewise.ai/threats/cve-2026-97196-improper-validation-of-unsafe-equivalence-in-input-vulnerability) (critical, CVSS 9.1, published 30 Sep 2026) - [CVE-2026-104405: GiveWP privilege escalation](https://junglewise.ai/threats/cve-2026-104405-unauthenticated-privilege-escalation-in-givewp-4-17-0-versions) (high, CVSS 8.1, published 6 Oct 2026) - [CVE-2026-96333: StellarWP GiveWP authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-96333-authentication-bypass-by-spoofing-vulnerability-in-liquid-web) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-66690: GiveWP unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-66690-givewp-unauthenticated-cross-site-scripting) (high, CVSS 7.1, published 6 Aug 2026) - [CVE-2026-104672: GiveWP cross-site scripting in core](https://junglewise.ai/threats/cve-2026-104672-unauthenticated-cross-site-scripting-xss-in-givewp-4-17-0) (high, CVSS 7.1, published 6 Oct 2026) - [CVE-2026-65441: Nexcess GiveWP unauthenticated XSS](https://junglewise.ai/threats/cve-2026-65441-nexcess-givewp-unauthenticated-xss) (high, CVSS 7.1, published 27 Jul 2026) - [CVE-2026-34900: GiveWP unauthenticated reflected XSS](https://junglewise.ai/threats/cve-2026-34900-givewp-unauthenticated-reflected-xss) (high, CVSS 7.1, published 15 Jun 2026) - [CVE-2026-42678: Liquid Web GiveWP DOM-based XSS](https://junglewise.ai/threats/cve-2026-42678-liquid-web-givewp-dom-based-xss) (high, CVSS 7.1, published 1 Jun 2026) - [CVE-2026-104404: StellarWP GiveWP stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104404-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 5 Oct 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 80% on the four before (5). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 1 | 0 | | 5 Oct 2026 | 4 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other StellarWP technologies - [StellarWP The Events Calendar](https://junglewise.ai/threats/technologies/the-events-calendar): 14 vulnerabilities - [StellarWP Event Tickets](https://junglewise.ai/threats/technologies/event-tickets): 7 vulnerabilities - [StellarWP Kadence Blocks](https://junglewise.ai/threats/technologies/kadence-blocks): 7 vulnerabilities - [StellarWP BookIt](https://junglewise.ai/threats/technologies/bookit): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "StellarWP GiveWP vulnerabilities", https://junglewise.ai/threats/technologies/givewp, 9 November 2026.