GiveWP – Donation Plugin and Fundraising Platform

90 Quality Score

Active Installs

23/30

With 100,000 active installs it is one of the most widely deployed donation plugins in the WordPress ecosystem, though its popularity score is moderated relative to the largest plugins overall.

Update Freshness

25/25

The plugin was updated within days of our review window and shows a perfect maintenance score, indicating active development and prompt responses to WordPress core changes.

User Rating

14/15

A 92 out of 100 rating across 705 user reviews signals consistently strong satisfaction from a large sample of real site owners.

Support Health

14/15

87.5% of the 24 tracked support threads are resolved, which is solid but the small thread volume suggests most users self-serve through documentation rather than opening tickets.

WP Compatibility

15/15

Tested against WordPress 7.0.1 and requiring PHP 7.4 plus WordPress 6.6, it is fully compatible with current stable versions of the stack.

Scores higher than 99% of indexed plugins

About

Accept donations and begin fundraising with GiveWP, the highest rated WordPress donation plugin for online giving.

Active Installs 100k+

Rating ★★★★½ 4.6/5

Last Updated 2026-09-23 5:56pm GMT

Requires WordPress 6.9+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

90 known vulnerabilities, all patched

9 Critical 11 High 70 Medium

Most recent: September 18, 2026

View details ▸

GiveWP <= 4.16.8 - Unauthenticated Arbitrary Shortcode Execution Medium

September 18, 2026 Patched in ["4.16.9"] CVE-2026-85113

GiveWP <= 4.16.8.0 - Unauthenticated Privilege Escalation High

September 14, 2026 Patched in ["4.16.8.1"] CVE-2026-85530

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.7.1 - Unauthenticated PHP Object Injection to Remote Code Execution Critical

August 28, 2026 Patched in ["4.16.7.2"] CVE-2026-82222

GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Medium

August 27, 2026 Patched in ["4.14.5"] CVE-2026-5510

GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization Medium

August 14, 2026 Patched in ["4.16.6"] CVE-2026-73348

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5.1 - Missing Authorization Medium

August 14, 2026 Patched in ["4.16.6"] CVE-2026-73352

GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Missing Authorization Medium

August 12, 2026 Patched in ["4.16.6"] CVE-2026-73349

GiveWP – Donation Plugin and Fundraising Platform < 4.16.6 - Authenticated (Donor+) Stored Cross-Site Scripting Medium

August 12, 2026 Patched in ["4.16.6"] CVE-2026-73357

GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Unauthenticated Payment Bypass Medium

August 4, 2026 Patched in ["4.16.3"] CVE-2026-14317

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.5 - Unauthenticated Stored Cross-Site Scripting High

July 31, 2026 Patched in ["4.16.5.1"] CVE-2026-66690

GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting Medium

July 30, 2026 Patched in ["4.16.3"] CVE-2026-14318

GiveWP <= 4.16.3 - Unauthenticated Stored Cross-Site Scripting High

July 27, 2026 Patched in ["4.16.4"] CVE-2026-65441

GiveWP – Donation Plugin and Fundraising Platform <= 4.16.3 - Cross-Site Request Forgery Medium

July 22, 2026 Patched in ["4.16.4"] CVE-2026-65464

GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting Medium

July 15, 2026 Patched in ["4.16.4"] CVE-2026-14987

GiveWP <= 4.16.2 - Unauthenticated Recurring Donor Information Disclosure Medium

July 13, 2026 Patched in ["4.16.3"] CVE-2026-14319

GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form Medium

July 1, 2026 Patched in ["4.16.2"] CVE-2026-13704

GiveWP <= 4.15.3 - Cross-Site Request Forgery Medium

June 30, 2026 Patched in ["4.15.4"] CVE-2026-11981

GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute Medium

June 30, 2026 Patched in ["4.16.1"] CVE-2026-13246

GiveWP – Donation Plugin and Fundraising Platform <= 4.14.5 - Unauthenticated Stored Cross-Site Scripting High

May 16, 2026 Patched in ["4.14.6"] CVE-2026-42678

GiveWP – Donation Plugin and Fundraising Platform <= 4.14.2 - Reflected Cross-Site Scripting Medium

April 21, 2026 Patched in ["4.14.3"] CVE-2026-34900

GiveWP <= 4.14.5 - Missing Authorization Medium

March 2, 2026 Patched in ["4.14.6"] CVE-2026-42642

GiveWP <= 4.13.1 - Unauthenticated Arbitrary Shortcode Execution Medium

January 8, 2026 Patched in ["4.13.2"] CVE-2025-66533

GiveWP <= 4.13.1 - Cross-Site Request Forgery Medium

December 23, 2025 Patched in ["4.13.2"] CVE-2025-67467

GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' High

November 18, 2025 Patched in ["4.13.1"] CVE-2025-13206

GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure Medium

October 3, 2025 Patched in ["4.10.1"] CVE-2025-11227

GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association Medium

October 3, 2025 Patched in ["4.10.1"] CVE-2025-11228

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update Medium

August 20, 2025 Patched in ["4.6.1"] CVE-2025-7221

GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure Medium

August 5, 2025 Patched in ["4.6.1"] CVE-2025-8620

GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting Medium

July 30, 2025 Patched in ["4.6.0"] CVE-2025-7205

GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification Medium

June 18, 2025 Patched in ["4.3.1"] CVE-2025-4571

GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure Medium

March 21, 2025 Patched in ["3.22.2"] CVE-2025-2331

Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function Medium

March 14, 2025 Patched in ["3.22.1"] CVE-2025-2025

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection Critical

March 3, 2025 Patched in ["3.20.0"] CVE-2025-0912

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.3 - Unauthenticated PHP Object Injection Critical

January 10, 2025 Patched in ["3.19.4"] CVE-2025-22777

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection Critical

January 10, 2025 Patched in ["3.19.3"] CVE-2024-12877

GiveWP – Donation Plugin and Fundraising Platform <= 3.18.0 - Reflected Cross-Site Scripting Medium

December 6, 2024 Patched in ["3.19.0"] CVE-2024-11921

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution Critical

October 15, 2024 Patched in ["3.16.4"] CVE-2024-9634

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection Critical

September 27, 2024 Patched in ["3.16.2"] CVE-2024-8353

GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter High

September 26, 2024 Patched in ["3.16.2"] CVE-2024-9130

GiveWP <= 3.15.1 - Cross-Site Request Forgery Medium

September 25, 2024 Patched in ["3.16.0"] CVE-2024-47315

GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure Medium

August 28, 2024 Patched in ["3.16.0"] CVE-2024-6551

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution Critical

August 19, 2024 Patched in ["3.14.2"] CVE-2024-5932

GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion Medium

August 19, 2024 Patched in ["3.14.2"] CVE-2024-5941

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure Medium

August 19, 2024 Patched in ["3.14.0"] CVE-2024-5939

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update Medium

August 19, 2024 Patched in ["3.14.0"] CVE-2024-5940

GiveWP <= 3.14.1 - Unauthenticated PHP Object Injection High

August 9, 2024 Patched in ["3.14.2"] CVE-2024-37099

GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions Medium

July 18, 2024 Patched in ["3.14.0"] CVE-2024-5977

GiveWP – Donation Plugin and Fundraising Platform <= 3.12.0 - Reflected Cross-Site Scripting Medium

June 6, 2024 Patched in ["3.12.1"] CVE-2024-35679

GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

May 17, 2024 Patched in ["3.11.0"] CVE-2024-3714

GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection High

April 26, 2024 Patched in ["3.5.0"] CVE-2024-30229

GiveWP – Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Medium

April 12, 2024 Patched in ["3.7.0"] CVE-2024-1957

GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

March 19, 2024 Patched in ["3.6.0"] CVE-2024-1424

GiveWP <= 3.3.1 - Reflected Cross-Site Scripting Medium

March 15, 2024 Patched in ["3.4.0"] CVE-2024-27987

GiveWP <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

January 19, 2024 Patched in ["3.3.0"] CVE-2023-51415

GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion Medium

October 31, 2023 Patched in ["2.33.4"] CVE-2023-4248

GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation Medium

October 31, 2023 Patched in ["2.33.4"] CVE-2023-4246

GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation Medium

October 31, 2023 Patched in ["2.33.4"] CVE-2023-4247

Give - Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation High

August 31, 2023 Patched in ["2.33.1"] CVE-2023-41665

GiveWP <= 2.25.3 - Authenticated (Admin+) PHP Object Injection Medium

May 10, 2023 Patched in ["2.26.0"] CVE-2023-32513

GiveWP <= 2.25.2 - Cross-Site Request Forgery Medium

March 23, 2023 Patched in ["2.25.3"]

GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_delete_payment_note Medium

March 23, 2023 Patched in ["2.25.3"]

GiveWP <= 2.25.2 - Cross-Site Request Forgery via give_ajax_store_payment_note Medium

March 23, 2023 Patched in ["2.25.3"]

GiveWP <= 2.25.1 - Authenticated (Contributor+) Arbitrary Content Deletion Medium

March 10, 2023 Patched in ["2.25.2"] CVE-2023-23672

GiveWP <= 2.25.1 - Authenticated (Author+) Stored Cross-Site Scripting Medium

March 10, 2023 Patched in ["2.25.2"] CVE-2022-40211

GiveWP <= 2.25.1 - Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler Medium

March 8, 2023 Patched in ["2.25.2"] CVE-2022-40312

GiveWP <= 2.25.1 - Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown Medium

March 8, 2023 Patched in ["2.25.2"]

GiveWP <= 2.25.1 - Unauthenticated CSV Injection High

March 8, 2023 Patched in ["2.25.2"] CVE-2023-22719

GiveWP <= 2.25.1 - Cross-Site Request Forgery via process_bulk_action Medium

March 8, 2023 Patched in ["2.25.2"]

GiveWP <= 2.25.1 - Cross-Site Request Forgery via give_cache_flush Medium

March 8, 2023 Patched in ["2.25.2"] CVE-2023-25450

GiveWP <= 2.25.1 - Cross-Site Request Forgery via save Medium

March 8, 2023 Patched in ["2.25.2"]

GiveWP <= 2.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via give_form_grid shortcode Medium

March 8, 2023 Patched in ["2.25.2"] CVE-2023-23668

GiveWP <= 2.23.2 - Unauthenticated SQL Injection Critical

January 19, 2023 Patched in ["2.24"] CVE-2023-0224

GiveWP <= 2.23.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

January 19, 2023 Patched in ["2.24"] CVE-2022-4448

GiveWP <= 2.20.2 - Authenticated Arbitrary File Read Medium

July 12, 2022 Patched in ["2.21.0"] CVE-2022-31475

GiveWP <= 2.20.2 - Authenticated Arbitrary File Creation Medium

July 12, 2022 Patched in ["2.21.0"] CVE-2022-28700

GiveWP <= 2.21.2 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

July 11, 2022 Patched in ["2.21.3"] CVE-2022-2215

GiveWP – Donation Plugin and Fundraising Platform <= 2.21.2 - Cross-Site Request Forgery Medium

July 8, 2022 Patched in ["2.21.3"] CVE-2022-2260

GiveWP – Donation Plugin and Fundraising Platform <= 2.20.2 - Sensitive Information Disclosure Medium

June 17, 2022 Patched in ["2.21.0"] CVE-2022-2117

GiveWP <= 2.17.2 - Reflected Cross-Site Scripting via Import Tool Medium

January 18, 2022 Patched in ["2.17.3"] CVE-2022-0252

GiveWP <= 2.17.2 - Reflected Cross-Site Scripting Medium

January 18, 2022 Patched in ["2.17.3"] CVE-2021-25100

GiveWP <= 2.17.2 - Reflected Cross-Site Scripting Medium

January 18, 2022 Patched in ["2.17.3"] CVE-2021-25099

GiveWP <= 2.11.3 - Authenticated Stored Cross-Site Scripting Medium

July 26, 2021 Patched in ["2.12.0"] CVE-2021-24524

GiveWP <= 2.10.3 - Authenticated Stored Cross-Site Scripting Medium

April 30, 2021 Patched in ["2.10.4"] CVE-2021-24315

GiveWP 2.4.0 - 2.9.7 - Reflected Cross Site Scripting Medium

March 23, 2021 Patched in ["2.10.0"] CVE-2021-24213

GiveWP <= 2.5.9 - Missing Authorization to Settings Update Medium

October 30, 2019 Patched in ["2.5.10"] CVE-2020-20627

GiveWP <= 2.5.4 - Authorization Bypass High

September 26, 2019 Patched in ["2.5.5"] CVE-2019-20360

GiveWP - Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection Critical

August 12, 2019 Patched in ["2.5.1"] CVE-2019-13578

GiveWP <= 2.4.6 - Cross-Site Scripting Medium

May 15, 2019 Patched in ["2.4.7"] CVE-2019-15317

GiveWP <= 2.3.0 - Cross-Site Scripting Medium

February 5, 2019 Patched in ["2.3.1"] CVE-2019-9909

GiveWP – Donation Plugin and Fundraising Platform < 0.8.5 - Reflected Cross-Site Scripting Medium

April 20, 2015 Patched in ["0.8.5"]

What It Does

GiveWP is a WordPress donation and fundraising platform that lets non-profits, charities, and creators accept one-time and recurring donations directly on their site. It supports multiple payment gateways, customizable donation forms, donor management, and built-in reporting for tracking gift activity. The plugin also extends into peer-to-peer fundraising and donor walls through add-ons.

Who It's For

This plugin is best suited for non-profits, churches, schools, political campaigns, and any organization that needs a dedicated, full-featured donation system separate from a general e-commerce store. It is a strong fit for teams that want donor CRM features, recurring giving, and granular form control without building a WooCommerce checkout. Organizations running multiple campaigns or coordinating with volunteers for peer-to-peer fundraising will get particular value from the add-on ecosystem.

Who Should Skip It

If you only need a simple 'donate' PayPal button or a one-off tip jar, GiveWP is overkill and the lighter Donations via PayPal plugin will be quicker to set up. Sites already running WooCommerce for product sales should also evaluate the Donation Platform for WooCommerce extension before installing a second, parallel payment system.

The Bottom Line

GiveWP earns an overall quality score of 89.32 out of 100 and is the most established WordPress-native donation platform, combining strong ratings, recent maintenance, and broad gateway support. It is the safest default choice for organizations serious about online fundraising, though smaller sites with simple needs will find lighter alternatives faster to deploy.

Pick this if your store already runs WooCommerce and you want donation functionality integrated into the existing cart, checkout, and order management rather than a separate system.

Donations via PayPal 81/100

Pick this if all you need is a lightweight PayPal donate button and you do not require donor management, recurring giving, or reporting.

Charitable 80/100

Pick this if you want strong campaign and front-end fundraising pages with a simpler admin experience and do not need the deeper add-on marketplace that GiveWP offers.

Better Payment 78/100

Pick this if you need a combined payments, donations, and subscription tool on a single, modern interface and are willing to trade GiveWP's larger install base for a newer option.

Paymattic 77/100

Pick this if you want a flexible payment and donation form builder with strong subscription support and a lighter footprint than GiveWP.

GiveWP – Donation Plugin and Fundraising Platform

About

Security History

What It Does

Who It's For

Who Should Skip It

The Bottom Line

Related Plugins

Tags