CVE-2025-11228

MediumCVSS 5.3/10Last modified Oct 11, 2026

Description

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. This makes it possible for unauthenticated attackers to associate any donation forms with any campaign.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
stellarwp	GiveWP – Donation Plugin and Fundraising Platform	<= 4.10.0

References

Timeline

Published: Oct 4, 2025
Last modified: Oct 11, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-112297.2The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications CVE-2025-11237.2The Solid Mail – SMTP email and logging made by SolidWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email Name, Su CVE-2025-112307.5Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON request CVE-2025-112327.5To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, w CVE-2025-112336.3Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, cau CVE-2025-112347.5A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This ca CVE-2025-112357.5Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from CVE-2025-112375.3The Make Email Customizer for WooCommerce WordPress plugin through 1.0.6 lacks proper authorization checks and option validation in its AJAX CVE-2025-112387.2The Watu Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer header in versions less than, or equal CVE-2025-112394.3Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting wit CVE-2025-112407.2An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link CVE-2025-112416.4The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to a flawed regex used