CVE-2023-0224

GiveWP < 2.24.1 - Unauthenticated SQLi

The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks

Affected

GiveWP

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.74% chance of exploitation in the next 30 days, 90th percentile

Published

2024-01-16

Updated

2025-06-13

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d8da539d-0a1b-46ef-b48d-710c59cf68e1/

Security advisories

• https://givewp.com/core-2-24-0-vulnerability-patched
• https://wpscan.com/vulnerability/d8da539d-0a1b-46ef-b48d-710c59cf68e1

References

• CVE Record
• NVD entry