Medium
CVE-2025-23934
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 196
Reset filters
Critical
CVE-2024-12877
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
Critical
CVE-2025-22777
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection
Medium
CVE-2024-11756
SweepWidget Contests, Giveaways, Photo Contests, Competitions <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-12545
Scratch & Win – Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function
Medium
CVE-2024-11722
Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection
Medium
CVE-2024-11921
GiveWP – Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-11201
myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
Medium
CVE-2024-11898
Scratch & Win – Giveaways and Contests <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-11456
Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-10187
myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Critical
CVE-2024-49332
Giveaway Boost <= 2.1.4 - Unauthenticated PHP Object Injection
Critical
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
Critical
CVE-2024-8353
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
High
CVE-2024-9130
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter
Medium
CVE-2024-47338
WPExperts Square For GiveWP <= 1.3 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2024-47315
GiveWP <= 3.15.1 - Cross-Site Request Forgery
Medium
CVE-2024-8658
myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade
Medium
CVE-2024-6551
GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6887
Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Editor+) Stored Cross-Site Scripting
Critical
CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
Medium
CVE-2024-5940
GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
Medium
CVE-2024-5939
GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure
Medium
CVE-2024-5941
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.