Patchstack's account of CVE-2026-82222 is the one worth reading line by line, because it names a shape rather than a symptom. The chain is a broken "safe unserialize" helper, a donation flow that feeds that helper attacker-controlled data, and a gadget chain in code that GiveWP itself ships [7]. Patchstack's framing is that PHP object injection becomes remote code execution when three ingredients line up: a place to store an attacker-controlled serialized object, code that later unserializes it, and a gadget chain in loaded classes [8]. The root causes it lists are trusting a serialization sanitizer that does not actually strip objects, unserializing data read back from the database as if the database were trusted, and shipping development-only libraries into production, where they provide ready-made gadget chains [9].
Four of the five need something else to be true before they fire [11]. WPMU DEV Dashboard requires the site to be connected to WPMU DEV with Hub SSO enabled and mapped to an administrator [1]. Avada's file write requires Fusion Builder installed and active at 3.16 or below [2]. TranslatePress requires automatic string saving enabled and a target administrator whose profile locale is set to a published secondary language [3]. GiveWP requires one published donation form and one active payment gateway [5]. Pods is the outlier with no stated configuration gate, which puts every install up to 3.3.9 in scope for unauthenticated privilege escalation [4][11].
Four are scored 9.8 and GiveWP 10.0 [10]. That is a spread of 0.2 across five different bug classes [15]. It tells you nothing about which one an attacker reaches on your estate first. The other detail in the wording: four entries specify an unauthenticated attacker, while the GiveWP entry says only "an attacker" [12].
The disclosures as summarised give affected version ceilings, not fixed versions [13], so the update target for each component has to come off the vendor changelog rather than the advisory. Nothing in them describes exploitation in the wild [14]. Wordfence and Patchstack are the reporting parties [6]. That silence on exploitation reflects an absence of reporting rather than time bought.
For an agency or marketing estate, the practical difference between these five is where the answer lives. Pods and Avada are answerable from a plugin and theme inventory. The WPMU DEV, TranslatePress and GiveWP conditions live in per-site settings, which means the triage question is a configuration query across the fleet, not a version report.
