CVE-2024-9130
Published
CVSS v3
7.2
HIGH
CVSS v2
N/A
Affected
1
PROJECT
Description
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.16.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, that can be used to extract sensitive information from the database.
<p><strong><a href="https://go.givewp.com/home" title="Visit the GiveWP website" rel="nofollow ugc">GiveWP</a></strong> is the highest rated, most downloaded, and best supported donation plugin for WordPress. Whether you need a simple donate button or a powerful donation platform optimized for online giving, GiveWP is right for you.</p>
<p>Transform the way you accept online donations, starting for free. With GiveWP you can accept gifts for charity or for other purposes, through customizable donation forms. Our donation plugin also allows you to view donor data and fundraising reports, manage donors, and integrate with a wide variety of third-party gateways and services.</p>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/dFjYyWLyB-k?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<h3>✨ GiveWP Features</h3>
<p>GiveWP is free and full of many advanced features to suit your needs. Start by choosing one of our donation form templates to create your first fundraising campaign. Then, take advantage of full-featured fundraising reports and donor management tools to increase your overall fundraising revenue by learning what makes donors donate.</p>
<p>Free donor tools also help keep your donors happy. The donor dashboard helps your donor base easily manage their accounts and access their donation history. With our <a href="https://go.givewp.com/addons" title="See all our Premium Add-ons" rel="nofollow ugc">premium add-ons</a>, you can add additional donor tools, like annual receipts.</p>
<p><strong><a href="https://docs.givewp.com/campaigns-release-readme" title="See how powerful our fundraising campaigns and forms can be" rel="nofollow ugc">Campaign-Based Fundraising and Forms</a></strong></p>
<p>GiveWP makes it easy to manage and launch successful fundraising campaigns directly from your WordPress site. Whether you’re raising funds for a single project, a long-term cause, or a series of initiatives, GiveWP’s campaign-based approach helps you streamline your efforts and maximize your fundraising potential.</p>
<h4><strong>Key Features of Campaign-Based Fundraising</strong></h4>
<ul>
<li><strong>Campaign Creation:</strong> Create multiple campaigns on your site, each with its own unique donation goal, target audience, and messaging.</li>
<li><strong>Customizable Donation Forms:</strong> Each campaign comes with a built-in, fully customizable landing page, created using the WordPress Block Editor. Add text, images, and donation forms to create a visually appealing and engaging page that strengthens your donor connections.</li>
<li><strong>Dedicated Landing Pages:</strong> Create custom landing pages for each campaign, complete with campaign-specific content, donation forms, progress bars, and social sharing options to engage and inspire donors.</li>
<li><strong>Organized Fundraising</strong>: All your donation forms are linked to specific campaigns. This makes it easy to manage and track your efforts, set goals, and monitor campaign performance in one streamlined view.</li>
<li><strong>Visibility Controls</strong>: Publish, archive, or draft campaigns to manage when and how your campaigns appear on your site. This gives you full control over the visibility of your campaigns and associated donation forms.</li>
</ul>
<h4><strong>How Campaigns and Donation Forms Work Together</strong></h4>
<p>GiveWP’s donation forms seamlessly integrate with your campaigns, allowing you to:</p>
<ul>
<li>Create forms that directly support the campaign’s fundraising goals.</li>
<li>Customize form fields to match the needs of your campaign, whether it’s a specific project or a general cause.</li>
<li>Promote campaigns via donation forms displayed on any page on your website.</li>
</ul>
<p>Campaigns offer more flexibility, better control, and enhanced organization for your fundraising efforts, making it easier to achieve your goals and connect with donors. Whether you’re running a large-scale initiative or multiple smaller projects, Campaigns will help you streamline the process and improve your overall fundraising strategy.</p>
<p>Never used blocks before? No worries – <a href="https://go.givewp.com/visual-builder" rel="nofollow ugc">we’ve got you covered with our guide</a>.</p>
<p><strong><a href="https://go.givewp.com/features-reports" title="See our gorgeous and helpful reports dashboards" rel="nofollow ugc">Actionable Fundraising Reporting</a></strong></p>
<ul>
<li>Get a detailed breakdown of your donation activity</li>
<li>Control your fundraising data with exports and reports</li>
<li>Filter reports by date, form, and payment method</li>
<li>Measure performance across multiple campaigns</li>
</ul>
<p><strong><a href="https://go.givewp.com/features-donor-management" title="See how our donor management tools help you enhance donor loyalty" rel="nofollow ugc">Complete Donor Management</a></strong></p>
<ul>
<li>View a complete history of your donor activity</li>
<li>Generate tax-deductible receipts</li>
<li>Allow donors to view their donation history, update their profile, manage their recurring donations, and download PDF receipts through their own donor dashboard</li>
</ul>
<p>Find out more:</p>
<ul>
<li><strong><a href="https://go.givewp.com/home" title="Visit the GiveWP website" rel="nofollow ugc">Visit the GiveWP website</a></strong></li>
<li><strong><a href="https://go.givewp.com/visual-builder" rel="nofollow ugc">Read our Docs on How to Use the Visual Form Builder</a>.</strong></li>
<li><strong><a href="https://go.givewp.com/addons" title="See all GiveWP Add-ons" rel="nofollow ugc">View GiveWP Premium Add-ons</a></strong></li>
<li><strong><a href="https://go.givewp.com/freeadds" title="See our free Add-ons" rel="nofollow ugc">View GiveWP Free Add-ons</a></strong></li>
<li><strong><a href="https://go.givewp.com/csdemo" title="Book a demo with our team" rel="nofollow ugc">Book a Live Demo with our Team</a></strong></li>
</ul>
<h3>🧑🏿🤝🧑🏿 Who Uses GiveWP?</h3>
<p>With more than 100,000+ active installs of GiveWP, we hear more and more success stories from nonprofit organizations. Causes are using GiveWP to raise millions of dollars per year. Check out some of our GiveWP Stories and Case Studies for details about their success.</p>
<ul>
<li><a href="https://go.givewp.com/cmstory" rel="nofollow ugc">The City Mission used GiveWP</a> for Giving Tuesday and a competition fundraiser with a neighboring organization, where they raised $45K in 16 hours.</li>
<li><a href="https://go.givewp.com/memstory" rel="nofollow ugc">A local neighborhood watch program</a> switched from using GoFundMe to GiveWP and raised $40,000 in five days for a memorial fundraiser.</li>
<li><a href="https://go.givewp.com/readivan" rel="nofollow ugc">Fans of Ivan the Gorilla have kept his memory alive</a> by fundraising for a conservancy program in his name.</li>
<li><a href="https://go.givewp.com/twiststory" rel="nofollow ugc">A hospital raised money</a> through a community-wide virtual dance party during the pandemic.</li>
<li><a href="https://go.givewp.com/quiltlove" rel="nofollow ugc">Quiltlove</a>, which provides personalized quilts for different life events (like new babies, extended hospital stays, and more), uses GiveWP to create a sustainable business model.</li>
<li><a href="https://go.givewp.com/niels-vink" rel="nofollow ugc">Niels Vink, a Dutch wheelchair tennis player</a>, uses GiveWP to raise money to train, travel, and participate in competitions. At the 2021 Tokyo Paralympics, Vink earned a gold medal in doubles and a bronze medal in singles.</li>
</ul>
<p>In addition to nonprofit organizations, GiveWP is widely used for individual or creative purposes. We’ve seen tip jars for blogs or musicians, live streams, and more. Our <a href="https://go.givewp.com/wooread" rel="nofollow ugc">Donation Upsells for WooCommerce Add-on</a> is even used in some eCommerce stores to collect donations for a cause, or ask for tips in the cart or checkout.</p>
<p>We’ve even seen GiveWP used to collect gifts for birthdays and weddings!</p>
<h3>💝 Simple and Pain-Free Giving</h3>
<p>We built GiveWP to be the best WordPress donation plugin from day one. Simply install and activate the plugin to get started.</p>
<p>The strength of GiveWP lies within its optimized donation forms. When creating a form, you can start with a template and customize the donation levels, including allowing donors to give a custom amount. The donation forms can then be displayed anywhere on your website using a block, shortcode, widget, or the single donation form page.<br />
You can also integrate your forms with a wide variety of payment processors, including PayPal and Stripe within the free plugin. You can also purchase add-ons to use Authorize,net, Bitpay, Square, and more.</p>
<h3>🌱 First Time Users</h3>
<span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/UNRa8Dc6Ayc?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span>
<p>For new users, we suggest reviewing our <a href="https://go.givewp.com/rmgettingstarted" title="Visit the GiveWP Getting Started Guide" rel="nofollow ugc">Getting Started Guide</a> to get an understanding of how the plugin works. If you run into any trouble, we offer <a href="https://wordpress.org/support/plugin/give" title="Visit the GiveWP support page on WordPress.org" rel="ugc">free support</a> to help you with your issues, questions, and concerns.</p>
<p>If you are a GiveWP customer with an active license of any of our popular add-ons, we’d love to hear from you and support you via our <a href="https://go.givewp.com/support" rel="nofollow ugc">Priority Support channel</a>.</p>
<h3>💳 Accept Credit Card Donations and More</h3>
<p>GiveWP comes with several payment gateway options:</p>
<ul>
<li><strong>Stripe Donations</strong> — Accept donations through any payment method (like Apple Pay, Google Pay, or ACH) activated in your Stripe accounts. Additional fees may apply for free users. Read our <a href="https://docs.givewp.com/stripe-fees" rel="nofollow ugc">Stripe documentation</a> for more information.</li>
<li><strong>PayPal Donations</strong> — Allow worldwide donations with PayPal Donations. No additional fees applied.</li>
<li><strong>Venmo Donations</strong> — Give donors the option to pay through Venmo with their account balance or connected bank account.</li>
<li><strong>Offline Donations</strong> — Enable your donors to send checks or physical donations with an offline gateway with instructions.</li>
<li><strong>Test Gateway</strong> — use the Test Gateway to see exactly how your donors will walk through the donation process.</li>
<li><strong>And many more Gateways</strong> – View additional payment gateways on our website. These include Authorize.net, Bitpay, Square, Razorpay, Paytm, and more.</li>
<li><strong>In-Person Donations (Tap To Pay)</strong> — Accept swipe, insert, or Tap to Pay card donations right from your mobile device or Stripe reader with <a href="https://wordpress.org/plugins/jovvie-in-person-payments-givewp/" rel="ugc">Jovvie</a>.</li>
</ul>
<h3>⚙️ Extend GiveWP with Powerful Add-ons</h3>
<p>GiveWP’s goal is to “Democratize Generosity.” We want to make it easy for <em>everyone</em> to raise funds online.</p>
<p>In addition to our free donation plugin, we have <a href="https://go.givewp.com/addons" title="View all of GiveWP's Premium Add-ons" rel="nofollow ugc">premium GiveWP add-ons</a> available to extend the functionality of GiveWP. Ultimately, these tools allow you to raise more money and give you a better relationship with your donors.</p>
<p>Must-Have Add-ons for GiveWP:</p>
<ul>
<li><a href="https://go.givewp.com/addon-recurring" rel="nofollow ugc">WordPress Recurring Donations</a></li>
<li><a href="https://go.givewp.com/p2pread" rel="nofollow ugc">Peer-to-Peer Fundraising</a></li>
<li><a href="https://go.givewp.com/text-to-give" rel="nofollow ugc">Text-to-Give</a></li>
<li><a href="https://go.givewp.com/form-field" rel="nofollow ugc">Form Field Manager</a></li>
<li><a href="https://go.givewp.com/fee-recovery" rel="nofollow ugc">Fee Recovery</a></li>
<li><a href="https://go.givewp.com/tributes" rel="nofollow ugc">Tributes</a></li>
<li><a href="https://givewp.com/addons/pdf-receipts/" rel="nofollow ugc">PDF Receipts</a></li>
<li><a href="https://go.givewp.com/read-funds-des" rel="nofollow ugc">Funds & Designations</a></li>
</ul>
<p><a href="https://go.givewp.com/addons" title="View all GiveWP add-ons" rel="nofollow ugc">View all of GiveWP’s Add-ons</a> to discover all the ways you can further enhance and extend GiveWP.</p>
<h3>🛠️ Easy to Customize and Enhance</h3>
<p>Are you a developer? GiveWP is built with best practices and easy to extend and customize. Here are some great developer-oriented tutorials and docs to help you customize GiveWP to your liking:</p>
<ul>
<li><a href="https://go.givewp.com/blog-emails" rel="nofollow ugc">Create Dramatic Donation Email Receipts</a></li>
<li><a href="https://go.givewp.com/blog-populate" rel="nofollow ugc">Populate Donor Info with One Click</a></li>
<li><a href="https://go.givewp.com/blog-api" rel="nofollow ugc">Using the GiveWP API to Create Charts with ChartJS</a></li>
<li><a href="https://go.givewp.com/docs-theming" rel="nofollow ugc">Theming with GiveWP</a></li>
<li><a href="https://go.givewp.com/docs-custom-fields" rel="nofollow ugc">How to Create Custom Form Fields in GiveWP</a></li>
<li><a href="https://go.givewp.com/gatewaydoc" rel="nofollow ugc">How to Build a Gateway Add-on for GiveWP</a></li>
<li><a href="https://go.givewp.com/styledoc" rel="nofollow ugc">How to Style Your GiveWP Forms</a></li>
<li><a href="https://go.givewp.com/datalossdoc" rel="nofollow ugc">Site Redesigns Without Donation Data Loss</a></li>
<li><a href="https://go.givewp.com/cssdoc" rel="nofollow ugc">Handling Custom CSS in WordPress</a></li>
</ul>
<h3>💚 About the GiveWP Team</h3>
<p>The most downloaded fundraising plugin on WordPress, Give has helped users raise over $350 million since 2009. Behind it is a professional team of WordPress developers who know what serious fundraising operations need: flexible tools, rock-solid reliability, and software that grows with your mission. As part of Nexcess’s software offerings, Give is backed by decades of experience building and hosting WordPress solutions.</p>
<h3>📧 Connect with GiveWP</h3>
<p>Stay in touch with us for important plugin news and updates:</p>
<ul>
<li><strong><a href="https://go.givewp.com/home" title="Visit the GiveWP website" rel="nofollow ugc">GiveWP Website</a></strong></li>
<li><strong><a href="https://go.givewp.com/subscribe" title="Subscribe to GiveWP via MailChimp" rel="nofollow ugc">GiveWP Newsletter</a></strong></li>
<li><strong><a href="https://go.givewp.com/fb" title="Visit the GiveWP on Facebook" rel="nofollow ugc">Facebook</a></strong></li>
<li><strong><a href="https://go.givewp.com/addons" title="View all GiveWP Add-ons" rel="nofollow ugc">GiveWP Add-ons</a></strong></li>
<li><strong><a href="https://go.givewp.com/rmwrite4us" rel="nofollow ugc">Write for GiveWP</a></strong></li>
</ul>
<h3>🐱💻 Contribute to GiveWP</h3>
<p>This plugin is proudly open source (GPL license) and we’re always looking for more contributors. Whether you know another language, love to code, or just have an idea, we would love your help and input.</p>
<p>Here’s a few ways you can contribute to GiveWP:</p>
<ul>
<li>
<p>Star/fork/watch the <a href="https://go.givewp.com/github" rel="nofollow ugc">GiveWP GitHub repository</a> to learn more about what issues we’re tackling and the project is developing. If you’ve never worked with Github before, learn about <a href="https://help.github.com/articles/about-pull-requests/" rel="nofollow ugc">pull requests here</a> and submit one for GiveWP, we’d love to give you our feedback.</p>
</li>
<li>
<p>Translate GiveWP into your native language. The best place to do that is here on wordpress.org. Go to <a href="https://translate.wordpress.org/projects/wp-plugins/give" rel="nofollow ugc">https://translate.wordpress.org/</a>, then search for your language, click the “Plugins” tab, then search for “GiveWP”. When you’ve submitted at least 95% of GiveWP’s strings, the language moderators will review and approve your translations and then they will be available to all WordPress users for your native language. If you are interested in translating any of our Premium Add-ons, <a href="https://go.givewp.com/contact" rel="nofollow ugc">contact us</a>, we’d love to chat with you about that.</p>
</li>
<li>
<p>Join the <a href="https://go.givewp.com/fb-group" rel="nofollow ugc">GiveWP Community Facebook group</a>. We chat about all things related to WordPress, GiveWP, fundraising, and online donations in general.</p>
</li>
</ul>