Input validation vulnerability in GiveWP – Donation Plugin and Fundraising Platform 2.25.1

The GiveWP plugin, which is used by some website owners, has a security flaw in versions up to and including 2.25.1. This issue occurs because the plugin was not properly protecting against Cross-Site Request Forgery. This means that it would be possible for unauthenticated attackers to add malicious code into the browser of an administrator. This could happen if an attacker tricked a website administrator into clicking on a link that contained malicious code inside a CSV file. Note that this would only be possible if the website had the setting ALLOW_UNFILTERED_UPLOADS enabled.