Gift Up Vulnerabilities

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to q...

CVSS:

7.2

Affected:

up to 3.1.7

Fixed in:

3.1.8

Disclosed:

Feb 25, 2026

CVE-2026-32412 on NVD →

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.21.3. This is due to missing or incorrect nonce validation on the consume_post function. This makes it possible for unauthenticated attackers to set the plugin's...

CVSS:

5.3

Affected:

up to 2.21.3

Fixed in:

2.22

Disclosed:

Dec 4, 2023

CVE-2023-49744 on NVD →

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.21.3. This is due to missing or incorrect nonce validation on the consume_post function. This makes it possible for unauthenticated attackers to set the plugin's...

CVSS:

5.3

Affected:

up to 2.21.3

Fixed in:

2.22

Disclosed:

Dec 1, 2023

The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authe...

CVSS:

6.4

Affected:

up to 2.20.1

Fixed in:

2.20.2

Disclosed:

Nov 3, 2023

CVE-2023-5703 on NVD →