Plugin Pulse Beta
← Pulse

GiveWP – Donation Plugin and Fundraising Platform

by Nexcess · Uncategorized

Also makes 23 other plugins · 2.6M+ installs across the portfolio →

Try it live ↗ wp.org ↗

Accept donations and begin fundraising with GiveWP, the highest rated WordPress donation plugin for online giving.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

A 92/100

no flags

Active installs

100K+

≈170K estimated

Momentum

+8%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 88/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
92 Health · A
Maintenance 100/100
Rating quality 91/100
Support 92/100
Security 75/100

92 health vs 58 average across 25,733 Uncategorized plugins

100K+

Active installs

≈170K estimated

12.8M

Total downloads

since 2015 · 0.8% still active

4.6/5

Rating

708 reviews · +0.2/wk

+8%

321.1K

Downloads · 30d

category median +7%

Install conversion

How it's measured →

0.8%

of downloads still active

At least 100K of 12.8M lifetime downloads are still running, in line with its category: the median Uncategorized plugin keeps 0.6%, across 17,767 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Uncategorized plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 38 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 708 reviews

Read on wp.org ↗
5★
622 4★
18 3★
10 2★
9 1★
49

Details

Version
4.19.1
Last updated
4d ago
Added
2015-04-07 · 11 yrs old
Requires WP
6.9
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

96 / 100

Excellent listing optimization

Well tuned across the board

Update recency 100/100

Updated 4 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 91/100

4.6★ over 708 reviews, smoothed to 4.57★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 88/100

15 of 17 support threads resolved in the last 2 months

Daily downloads

Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive

+8% vs prior 30d
3.6K31 Oct 2026

30-day downloads

Rolling 30-day volume · peak 349K · peaks are release surges

320.3K31 Oct 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

GiveWP · #374youCharitable · #1593FundEngine · #6755Mission · #17437

Rating trend

Star average over time · dips mark rough releases

4.631 Oct 2026

Health trend

Composite health score, snapshotted daily

9231 Oct 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

3.2K31 Oct 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

38

releases in the last 12 months

4d ago

latest release · v4.19.1 · 27 Oct 2026

261

tagged releases on record

Recent releases

4.19.1 · 27 Oct 20264.19.0.2 · 26 Oct 20264.19.0.1 · 22 Oct 20264.19.0 · 13 Oct 20264.18.0.1 · 6 Oct 20264.18.0 · 1 Oct 20264.17.0 · 23 Sep 20264.16.9 · 16 Sep 20264.16.8.1 · 10 Sep 20264.16.8 · 3 Sep 20264.16.7.2 · 27 Aug 20264.16.7.1 · 24 Aug 20264.16.7 · 20 Aug 20264.16.6.1 · 12 Aug 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v4.16 46%
v4.14 9.3%
v4.15 9.1%
Older / other versions 36%

Estimated active installs

The public count shows “100K+”. Our estimate pins where the real number sits.

tracked estimate
100K–200K ≈170K

Crossed into this band 4.1 years ago; the previous band took 5.8 years to cross, which places it about 71% of the way through.

Install history since 1 Feb 2016

100K31 Oct 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ banannah
    4mo ago

    Apparently this plugin has been bought by Liquid Web and along with other plugins they have bought there are issues with license activation. My client purchased a license weeks ago and we’re still struggling. Support is useless, giving instructions for things that don’t exist. All of the documentation is out of date so there’s no way to find out how this new process is supposed to work. I am going to recommend my client gets a refund.

    Read on wp.org ↗
  2. ★★★★★ stellr
    4mo ago

    Everything I don’t understand I ask and receive very detailed responses. Also, they include video demonstrations of solutions, which is very helpful.

    Read on wp.org ↗
  3. ★★★★★ apra2021
    6mo ago

    Thanks a lot for your great and immediate support that fixed the problem in my website.

    Read on wp.org ↗
  4. ★★★★★ crisascunce
    6mo ago

    When you’re in a crunch for time and everything seems to be going wrong, that’s when you want fast and hassle-free support! That’s what GiveWP gives you!

    Read on wp.org ↗
  5. ★★★★★ singletrackgrunt
    6mo ago

    Amazing support. Totally worth it!

    Read on wp.org ↗
  6. ★★★★★ gmzephi
    7mo ago

    We have used GiveWP on a couple of client sites now. It is not often that we encounter issues with the plugin, it runs well and offers some great features. However, if and when their is an issue, I have always found their support to be first class. They are quick to respond, thorough in their investigations, and communicative throughout the resolution process.

    Read on wp.org ↗
  7. ★★★★★ jms1017
    7mo ago

    Great support, stuck with the problem through completion.

    Read on wp.org ↗
  8. ★★★★★ carlamurray
    7mo ago

    Alex C is the best support tech ever. He is kind, patient and knowledgeable. He made sure to follow through all the way until the end which is rare and exceptional. Thanks Alex!!

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. — Version 4.16.5 Fix: Resolved an issue where selecting a donation amount level would also select other levels with the same value. Fix: Resolved an issue where extra separators could render in the donation confirmation page header when 4.16.5
  2. — Version 4.16.4 Security: Added additional validation to the core settings importer. Security: Added additional escaping to donor information displayed in the admin. Security: Added additional escaping to the Sequoia (Multi-Step Form) t 4.16.4
  3. — Version 4.16.3 Security: Added additional validation to ensure donation gateway selection respects the enabled payment gateway settings. Security: Improved escaping of donation form template output. Security: Improved the security of t 4.16.3
  4. — Version 4.16.2 Security: Added additional escaping and sanitization to the Sequoia (Multi-Step Form) template settings and donation form markup (CVE-2026-13704). 4.16.2
  5. — Version 4.16.1 Security: Standardized email access confirmation AJAX responses to prevent distinguishable server responses. Security: Added additional escaping and sanitization to the Campaign Comments block and shortcode attributes (C 4.16.1
  6. — Version 4.16.0 Feature: Added an optional donation ID parameter to gateway webhook event handlers, allowing gateways to locate donations when the transaction ID is only available in the webhook payload. Fix: Resolved an issue where mul 4.16.0

Security history

via Wordfence Intelligence

All 107 disclosed vulnerabilities are patched in the current version (4.19.1). Sites still on an older version should update.

  1. Patched Medium · 6.4 GiveWP <= 4.19.0.0 - Authenticated (Give Worker+) Stored Cross-Site Scripting ↗
    2026-10-23 CVE-2026-111979 Improper Neutralization of Input During Web Page Generation Affects <= 4.19.0.0 Patched in 4.19.0.1
  2. Patched Medium · 4.3 GiveWP <= 4.19.0.0 - Missing Authorization ↗
    2026-10-23 CVE-2026-111980 Incorrect Authorization Affects <= 4.19.0.0 Patched in 4.19.0.1
  3. Patched Medium · 5.3 GiveWP <= 4.19.0.0 - Unauthenticated Donation Amount Restriction Bypass ↗
    2026-10-23 CVE-2026-111974 Client-Side Enforcement of Server-Side Security Affects <= 4.19.0.0 Patched in 4.19.0.1
  4. Patched Medium · 4.3 GiveWP <= 4.19.0.0 - Missing Authorization ↗
    2026-10-23 CVE-2026-111981 Missing Authorization Affects <= 4.19.0.0 Patched in 4.19.0.1
  5. Patched Medium · 5.3 GiveWP <= 4.19.0.0 - Unauthenticated Information Exposure ↗
    2026-10-23 CVE-2026-111976 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.19.0.0 Patched in 4.19.0.1
  6. Patched Medium · 6.5 GiveWP <= 4.19.0.0 - Authenticated (Give Manager+) Path Traversal ↗
    2026-10-23 CVE-2026-111978 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.19.0.0 Patched in 4.19.0.1
  7. Patched Medium · 6.4 GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes ↗
    2026-10-09 CVE-2026-97643 Improper Neutralization of Input During Web Page Generation Affects <= 4.17.0 Patched in 4.18.0
  8. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.18.0 - Missing Authorization ↗
    2026-10-08 CVE-2026-106600 Missing Authorization Affects <= 4.18.0 Patched in 4.18.0.1
  9. Patched High · 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-10-05 CVE-2026-104672 Improper Neutralization of Input During Web Page Generation Affects <= 4.17.0 Patched in 4.18.0
  10. Patched High · 7.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Unauthenticated Privilege Escalation ↗
    2026-10-05 CVE-2026-104405 Improper Privilege Management Affects <= 4.17.0 Patched in 4.18.0
  11. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2026-10-05 CVE-2026-104404 Improper Neutralization of Input During Web Page Generation Affects <= 4.17.0 Patched in 4.18.0
  12. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.8.1 - Unauthenticated Payment Bypass ↗
    2026-10-02 CVE-2026-96333 Client-Side Enforcement of Server-Side Security Affects <= 4.16.8.1 Patched in 4.16.9
  13. Patched High · 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-24 CVE-2026-96830 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.9 Patched in 4.17.0
  14. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated User Impersonation ↗
    2026-09-24 CVE-2026-97196 Improper Authentication Affects <= 4.16.9 Patched in 4.17.0
  15. Patched Medium · 4.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Authenticated (Subscriber+) Information Exposure ↗
    2026-09-24 CVE-2026-96834 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.16.9 Patched in 4.17.0
  16. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.9 - Unauthenticated Insecure Direct Object Reference ↗
    2026-09-24 CVE-2026-97066 Authorization Bypass Through User-Controlled Key Affects <= 4.16.9 Patched in 4.17.0
  17. Patched Medium · 6.5 GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-09-18 CVE-2026-85113 Improper Control of Generation of Code Affects <= 4.16.8 Patched in 4.16.9
  18. Patched High · 7.3 GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation ↗
    2026-09-14 CVE-2026-85530 Improper Privilege Management Affects <= 4.16.8.0 Patched in 4.16.8.1
  19. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.7.1 - Unauthenticated PHP Object Injection to Remote Code Execution ↗
    2026-08-28 CVE-2026-82222 Deserialization of Untrusted Data Affects <= 4.16.7.1 Patched in 4.16.7.2
  20. Patched Medium · 6.4 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ↗
    2026-08-27 CVE-2026-5510 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.4 Patched in 4.14.5
  21. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization ↗
    2026-08-14 CVE-2026-73348 Missing Authorization Affects < 4.16.6 Patched in 4.16.6
  22. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization ↗
    2026-08-14 CVE-2026-73352 Missing Authorization Affects <= 4.16.5.1 Patched in 4.16.6
  23. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization ↗
    2026-08-12 CVE-2026-73349 Missing Authorization Affects < 4.16.6 Patched in 4.16.6
  24. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting ↗
    2026-08-12 CVE-2026-73357 Improper Neutralization of Input During Web Page Generation Affects < 4.16.6 Patched in 4.16.6
  25. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass ↗
    2026-08-04 CVE-2026-14317 Missing Authorization Affects < 4.16.3 Patched in 4.16.3
  26. Patched High · 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-07-31 CVE-2026-66690 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.5 Patched in 4.16.5.1
  27. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting ↗
    2026-07-30 CVE-2026-14318 Improper Neutralization of Input During Web Page Generation Affects < 4.16.3 Patched in 4.16.3
  28. Patched High · 7.2 GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-07-27 CVE-2026-65441 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.3 Patched in 4.16.4
  29. Patched Medium · 4.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery ↗
    2026-07-22 CVE-2026-65464 Cross-Site Request Forgery Affects <= 4.16.3 Patched in 4.16.4
  30. Patched Medium · 6.4 GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting ↗
    2026-07-15 CVE-2026-14987 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.3 Patched in 4.16.4
  31. Patched Medium · 5.3 GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure ↗
    2026-07-13 CVE-2026-14319 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.16.2 Patched in 4.16.3
  32. Patched Medium · 6.4 GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form ↗
    2026-07-01 CVE-2026-13704 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.1 Patched in 4.16.2
  33. Patched Medium · 4.3 GiveWP <= 4.15.3 - Cross-Site Request Forgery ↗
    2026-06-30 CVE-2026-11981 Cross-Site Request Forgery Affects <= 4.15.3 Patched in 4.15.4
  34. Patched Medium · 6.4 GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute ↗
    2026-06-30 CVE-2026-13246 Improper Neutralization of Input During Web Page Generation Affects <= 4.16.0 Patched in 4.16.1
  35. Patched High · 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-05-16 CVE-2026-42678 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.5 Patched in 4.14.6
  36. Patched Medium · 6.1 GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting ↗
    2026-04-21 CVE-2026-34900 Improper Neutralization of Input During Web Page Generation Affects <= 4.14.2 Patched in 4.14.3
  37. Patched Medium · 5.3 GiveWP <= 4.14.5 - Missing Authorization ↗
    2026-03-02 CVE-2026-42642 Missing Authorization Affects <= 4.14.5 Patched in 4.14.6
  38. Patched Medium · 6.5 GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-01-08 CVE-2025-66533 Improper Control of Generation of Code Affects <= 4.13.1 Patched in 4.13.2
  39. Patched Medium · 4.3 GiveWP <= 4.13.1 - Cross-Site Request Forgery ↗
    2025-12-23 CVE-2025-67467 Cross-Site Request Forgery Affects <= 4.13.1 Patched in 4.13.2
  40. Patched High · 7.2 GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' ↗
    2025-11-18 CVE-2025-13206 Improper Neutralization of Input During Web Page Generation Affects <= 4.13.0 Patched in 4.13.1
  41. Patched Medium · 6.5 GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure ↗
    2025-10-03 CVE-2025-11227 Improper Authorization Affects <= 4.10.0 Patched in 4.10.1
  42. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association ↗
    2025-10-03 CVE-2025-11228 Missing Authorization Affects <= 4.10.0 Patched in 4.10.1
  43. Patched Medium · 4.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update ↗
    2025-08-20 CVE-2025-7221 Improper Authorization Affects <= 4.5.0 Patched in 4.6.1
  44. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure ↗
    2025-08-05 CVE-2025-8620 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.6.0 Patched in 4.6.1
  45. Patched Medium · 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting ↗
    2025-07-30 CVE-2025-7205 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.0 Patched in 4.6.0
  46. Patched Medium · 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification ↗
    2025-06-18 CVE-2025-4571 Missing Authorization Affects <= 4.3.0 Patched in 4.3.1
  47. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure ↗
    2025-03-21 CVE-2025-2331 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.22.1 Patched in 3.22.2
  48. Patched Medium · 6.5 Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function ↗
    2025-03-14 CVE-2025-2025 Missing Authorization Affects <= 3.22.0 Patched in 3.22.1
  49. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection ↗
    2025-03-03 CVE-2025-0912 Deserialization of Untrusted Data Affects <= 3.19.4 Patched in 3.20.0
  50. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection ↗
    2025-01-10 CVE-2025-22777 Deserialization of Untrusted Data Affects <= 3.19.3 Patched in 3.19.4
  51. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection ↗
    2025-01-10 CVE-2024-12877 Deserialization of Untrusted Data Affects <= 3.19.2 Patched in 3.19.3
  52. Patched Medium · 6.1 GiveWP – Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting ↗
    2024-12-06 CVE-2024-11921 Improper Neutralization of Input During Web Page Generation Affects <= 3.18.0 Patched in 3.19.0
  53. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution ↗
    2024-10-15 CVE-2024-9634 Deserialization of Untrusted Data Affects <= 3.16.3 Patched in 3.16.4
  54. Patched Critical · 9.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection ↗
    2024-09-27 CVE-2024-8353 Deserialization of Untrusted Data Affects <= 3.16.1 Patched in 3.16.2
  55. Patched High · 7.2 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter ↗
    2024-09-26 CVE-2024-9130 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.16.1 Patched in 3.16.2
  56. Patched Medium · 4.3 GiveWP <= 3.15.1 - Cross-Site Request Forgery ↗
    2024-09-25 CVE-2024-47315 Cross-Site Request Forgery Affects <= 3.15.1 Patched in 3.16.0
  57. Patched Medium · 5.3 GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure ↗
    2024-08-28 CVE-2024-6551 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.15.1 Patched in 3.16.0
  58. Patched Critical · 10.0 GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution ↗
    2024-08-19 CVE-2024-5932 Deserialization of Untrusted Data Affects <= 3.14.1 Patched in 3.14.2
  59. Patched Medium · 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion ↗
    2024-08-19 CVE-2024-5941 Missing Authorization Affects <= 3.14.1 Patched in 3.14.2
  60. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure ↗
    2024-08-19 CVE-2024-5939 Missing Authorization Affects <= 3.13.0 Patched in 3.14.0
  61. Patched Medium · 6.5 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update ↗
    2024-08-19 CVE-2024-5940 Missing Authorization Affects <= 3.13.0 Patched in 3.14.0
  62. Patched High · 8.1 GiveWP <= 3.14.1 - Unauthenticated PHP Object Injection ↗
    2024-08-09 CVE-2024-37099 Deserialization of Untrusted Data Affects <= 3.14.1 Patched in 3.14.2
  63. Patched Medium · 5.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions ↗
    2024-07-18 CVE-2024-5977 Authorization Bypass Through User-Controlled Key Affects <= 3.13.0 Patched in 3.14.0
  64. Patched Medium · 6.1 GiveWP – Donation Plugin and Fundraising Platform <= 3.12.0 - Reflected Cross-Site Scripting ↗
    2024-06-06 CVE-2024-35679 Improper Neutralization of Input During Web Page Generation Affects <= 3.12.0 Patched in 3.12.1
  65. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-05-17 CVE-2024-3714 Improper Neutralization of Input During Web Page Generation Affects <= 3.10.0 Patched in 3.11.0
  66. Patched High · 8.8 GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection ↗
    2024-04-26 CVE-2024-30229 Deserialization of Untrusted Data Affects <= 3.4.2 Patched in 3.5.0
  67. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2024-04-12 CVE-2024-1957 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.1 Patched in 3.7.0
  68. Patched Medium · 6.4 GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-19 CVE-2024-1424 Improper Neutralization of Input During Web Page Generation Affects <= 3.5.1 Patched in 3.6.0
  69. Patched Medium · 6.1 GiveWP <= 3.3.1 - Reflected Cross-Site Scripting ↗
    2024-03-15 CVE-2024-27987 Improper Neutralization of Input During Web Page Generation Affects <= 3.3.1 Patched in 3.4.0
  70. Patched Medium · 6.4 GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-01-19 CVE-2023-51415 Improper Neutralization of Input During Web Page Generation Affects <= 3.2.2 Patched in 3.3.0
  71. Patched Medium · 5.4 GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion ↗
    2023-10-31 CVE-2023-4248 Cross-Site Request Forgery Affects <= 2.33.3 Patched in 2.33.4
  72. Patched Medium · 5.3 GiveWP <= 2.33.1 - Missing Authorization via handleBeforeGateway ↗
    2023-10-31 CVE-2023-47183 Missing Authorization Affects <= 2.33.1 Patched in 2.33.2
  73. Patched Medium · 4.3 GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation ↗
    2023-10-31 CVE-2023-4246 Cross-Site Request Forgery Affects <= 2.33.3 Patched in 2.33.4
  74. Patched Medium · 5.4 GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation ↗
    2023-10-31 CVE-2023-4247 Cross-Site Request Forgery Affects <= 2.33.3 Patched in 2.33.4
  75. Patched High · 7.2 Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation ↗
    2023-08-31 CVE-2023-41665 Improper Input Validation Affects < 2.33.1 Patched in 2.33.1
  76. Patched Medium · 6.6 GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection ↗
    2023-05-10 CVE-2023-32513 Deserialization of Untrusted Data Affects <= 2.25.3 Patched in 2.26.0
  77. Patched Medium · 4.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery ↗
    2023-03-23 Cross-Site Request Forgery Affects <= 2.25.2 Patched in 2.25.3
  78. Patched Medium · 5.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note ↗
    2023-03-23 Cross-Site Request Forgery Affects <= 2.25.2 Patched in 2.25.3
  79. Patched Medium · 5.3 GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note ↗
    2023-03-23 Cross-Site Request Forgery Affects <= 2.25.2 Patched in 2.25.3
  80. Patched Medium · 5.4 GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion ↗
    2023-03-10 CVE-2023-23672 Improper Authorization Affects <= 2.25.1 Patched in 2.25.2
  81. Patched Medium · 6.4 GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2023-03-10 CVE-2022-40211 Improper Neutralization of Input During Web Page Generation Affects <= 2.25.1 Patched in 2.25.2
  82. Patched Medium · 4.1 GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler ↗
    2023-03-08 CVE-2022-40312 Server-Side Request Forgery Affects <= 2.25.1 Patched in 2.25.2
  83. Patched Medium · 6.1 GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown ↗
    2023-03-08 Cross-Site Request Forgery Affects <= 2.25.1 Patched in 2.25.2
  84. Patched High · 8.3 GiveWP <= 2.25.1 - Unauthenticated CSV Injection ↗
    2023-03-08 CVE-2023-22719 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 2.25.1 Patched in 2.25.2
  85. Patched Medium · 5.4 GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action ↗
    2023-03-08 Cross-Site Request Forgery Affects <= 2.25.1 Patched in 2.25.2
  86. Patched Medium · 4.3 GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush ↗
    2023-03-08 CVE-2023-25450 Cross-Site Request Forgery Affects <= 2.25.1 Patched in 2.25.2
  87. Patched Medium · 4.3 GiveWP <= 2.25.1 - Cross-Site Request Forgery via save ↗
    2023-03-08 Cross-Site Request Forgery Affects <= 2.25.1 Patched in 2.25.2
  88. Patched Medium · 6.4 GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode ↗
    2023-03-08 CVE-2023-23668 Improper Neutralization of Input During Web Page Generation Affects <= 2.25.1 Patched in 2.25.2
  89. Patched Critical · 9.8 GiveWP <= 2.23.2 - Unauthenticated SQL Injection ↗
    2023-01-19 CVE-2023-0224 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.23.2 Patched in 2.24
  90. Patched Medium · 6.4 GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-01-19 CVE-2022-4448 Improper Neutralization of Input During Web Page Generation Affects <= 2.23.2 Patched in 2.24
  91. Patched Medium · 4.9 GiveWP <= 2.20.2 - Authenticated Arbitrary File Read ↗
    2022-07-12 CVE-2022-31475 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.20.2 Patched in 2.21.0
  92. Patched Medium · 5.5 GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation ↗
    2022-07-12 CVE-2022-28700 Improper Authorization Affects <= 2.20.2 Patched in 2.21.0
  93. Patched Medium · 5.5 GiveWP <= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2022-07-11 CVE-2022-2215 Improper Neutralization of Input During Web Page Generation Affects <= 2.21.2 Patched in 2.21.3
  94. Patched Medium · 4.3 GiveWP – Donation Plugin and Fundraising Platform <= 2.21.2 - Cross-Site Request Forgery ↗
    2022-07-08 CVE-2022-2260 Cross-Site Request Forgery Affects <= 2.21.2 Patched in 2.21.3
  95. Patched Medium · 5.3 GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure ↗
    2022-06-17 CVE-2022-2117 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 2.20.2 Patched in 2.21.0
  96. Patched Medium · 4.8 GiveWP <= 2.17.2 - Reflected Cross-Site Scripting via Import Tool ↗
    2022-01-18 CVE-2022-0252 Improper Neutralization of Input During Web Page Generation Affects < 2.17.3 Patched in 2.17.3
  97. Patched Medium · 6.1 GiveWP <= 2.17.2 - Reflected Cross-Site Scripting ↗
    2022-01-18 CVE-2021-25100 Improper Neutralization of Input During Web Page Generation Affects < 2.17.3 Patched in 2.17.3
  98. Patched Medium · 6.1 GiveWP <= 2.17.2 - Reflected Cross-Site Scripting ↗
    2022-01-18 CVE-2021-25099 Improper Neutralization of Input During Web Page Generation Affects < 2.17.3 Patched in 2.17.3
  99. Patched Medium · 4.8 GiveWP <= 2.11.3 - Authenticated Stored Cross-Site Scripting ↗
    2021-07-26 CVE-2021-24524 Improper Neutralization of Input During Web Page Generation Affects < 2.12.0 Patched in 2.12.0
  100. Patched Medium · 4.8 GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting ↗
    2021-04-30 CVE-2021-24315 Improper Neutralization of Input During Web Page Generation Affects < 2.10.4 Patched in 2.10.4
  101. Patched Medium · 6.1 GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting ↗
    2021-03-23 CVE-2021-24213 Improper Neutralization of Input During Web Page Generation Affects 2.4.0 - 2.10.0 Patched in 2.10.0
  102. Patched Medium · 5.3 GiveWP <= 2.5.9 - Missing Authorization to Settings Update ↗
    2019-10-30 CVE-2020-20627 Missing Authorization Affects < 2.5.10 Patched in 2.5.10
  103. Patched High · 7.5 GiveWP <= 2.5.4 - Authorization Bypass ↗
    2019-09-26 CVE-2019-20360 Improper Authorization Affects <= 2.5.4 Patched in 2.5.5
  104. Patched Critical · 9.8 GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection ↗
    2019-08-12 CVE-2019-13578 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.5.0 Patched in 2.5.1
  105. Patched Medium · 5.4 GiveWP <= 2.4.6 - Cross-Site Scripting ↗
    2019-05-15 CVE-2019-15317 Improper Neutralization of Input During Web Page Generation Affects < 2.4.7 Patched in 2.4.7
  106. Patched Medium · 6.1 GiveWP <= 2.3.0 - Cross-Site Scripting ↗
    2019-02-05 CVE-2019-9909 Improper Neutralization of Input During Web Page Generation Affects < 2.3.1 Patched in 2.3.1
  107. Patched Medium · 6.1 GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation Affects < 0.8.5 Patched in 0.8.5

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

✕ Low memory footprint
✓ Low page-speed impact
✕ Runs on latest PHP + WP
✕ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 114 languages, 10 at 90% or more

Persian 100%
Dutch 99%
Dutch (Formal) 99%
Galician 99%
Serbian 99%
Czech 98%
Korean 98%
Lao 98%
Polish 98%
Italian 90%
French (France) 89%
Spanish (Chile) 87%
Spanish (Spain) 86%
Portuguese (Brazil) 71%
English (Australia) 66%
English (New Zealand) 66%
English (Canada) 65%
German 65%
Spanish (Mexico) 64%
Ukrainian 63%
English (UK) 62%
Spanish (Colombia) 61%
Spanish (Ecuador) 61%
Spanish (Venezuela) 61%

Plus 90 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names GiveWP when asked about this topic, where it comes in the answer, and how that compares with its wp.org search position. Latest run 25 Oct 2026.

Assistants
ChatGPT, Claude
Topics tracked
Landing pages
Get early access to Premium →

Readme readiness

7 of 8 pass · checked 31 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ✓ Says what it does "Accept donations and begin fundraising with GiveWP, the highest rated WordPress donation plugin for online..."
  • ✓ Has a FAQ 8 questions in the FAQ.
  • ✓ FAQ asks real questions 8 of 8 read like questions a user would type.
  • ! Names who it is for One audience phrase ("if you run"); say who the plugin is for and what they use it for.
  • ✓ Names what it works with Mentions WooCommerce, Block editor, Stripe, PayPal and 1 more.
  • ✓ Headings and lists 12 headings and 11 lists.
  • ✓ Enough to quote 10,975 characters of description.
  • ✓ Tags match the text 4 of 5 tags appear in the text; "crowdfunding" does not.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2022-10-04 20K+ → 100K+ up after 2099 days in tier
  2. 2017-01-04 10K+ → 20K+ up after 237 days in tier
  3. 2016-05-12 8K+ → 10K+ up after 63 days in tier
  4. 2016-03-10 6K+ → 8K+ up after 38 days in tier
  5. 2016-02-01 5K+ → 6K+ up after 31 days in tier
  6. 2016-01-01 4K+ → 5K+ up after 31 days in tier
  7. 2015-12-01 3K+ → 4K+ up after 46 days in tier
  8. 2015-10-16 2K+ → 3K+ up after 63 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for GiveWP – Donation Plugin and Fundraising Platform into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/give" width="480" height="300" style="border:0" loading="lazy" title="GiveWP – Donation Plugin and Fundraising Platform — Plugin Pulse"></iframe>
Preview card ↗

GiveWP – Donation Plugin and Fundraising Platform: 100K+ active installs, 4.6★ (708 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/give

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.