VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 17 known issues Latest disclosed Jun 05, 2026

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Vulnerabilities

Review known vulnerability records for the WordPress plugin Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (`charitable`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-10038, CVE-2026-7619 and CVE-2026-3177, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
17
High or Critical
3
Patch Coverage
100%
Last Updated
Jun 05, 2026
Related Security Guides

Use these guides while reviewing Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
15
1. Match the Package
Confirm the installed WordPress plugin slug is charitable before acting on any CVE from this cluster.
2. Sort by Severity
Start with 3 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
17 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2024-8791 Critical
Authorization Bypass remediation for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Affected range: Versions up to 1.8.1.14. Fixed version: 1.8.1.15.

CVE-2023-4404 Critical
Privilege Escalation remediation for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Affected range: Versions up to 1.7.0.12. Fixed version: 1.7.0.13.

CVE-2026-7619 Medium
SQL Injection remediation for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Affected range: Versions up to 1.8.10.4. Fixed version: 1.8.10.5.

CVE-2025-11893 Medium
SQL Injection remediation for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Affected range: Versions up to 1.8.8.4. Fixed version: 1.8.8.5.

Priority CVE Quick Links

Fast paths into Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
16
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2024-8791
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress...
 Authorization Bypass Versions up to 1.8.1.14 1.8.1.15 CVSS 9.8
CVE-2023-4404
Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation
 Privilege Escalation Versions up to 1.7.0.12 1.7.0.13 CVSS 9.8
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parame...
 SQL Injection Versions up to 1.8.10.4 1.8.10.5 CVSS 6.5
CVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &...
 SQL Injection Versions up to 1.8.8.4 1.8.8.5 CVSS 6.5
CVE-2025-30770
Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 1.8.4.7 1.8.4.8 CVSS 6.4
CVE-2023-47816
Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions before 1.7.0.14 1.7.0.14 CVSS 6.4
CVE-2021-24531
Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions up to 1.6.50 1.6.51 CVSS 6.4
CVE-2024-10876
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations &...
 Cross-Site Scripting Versions up to 1.8.3 1.8.3.1 CVSS 6.1
CVE-2024-8791 Critical 1.8.1.15
CVE-2024-8791 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Authorization Bypass

Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

CVE-2023-4404 Critical 1.7.0.13
CVE-2023-4404 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Privilege Escalation

Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation

CVE-2026-7619 Medium 1.8.10.5
CVE-2026-7619 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More SQL Injection

Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter

CVE-2025-11893 Medium 1.8.8.5
CVE-2025-11893 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More SQL Injection

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection

CVE-2025-30770 Medium 1.8.4.8
CVE-2025-30770 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Stored Cross-Site Scripting

Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2023-47816 Medium 1.7.0.14
CVE-2023-47816 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Stored Cross-Site Scripting

Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting

CVE-2021-24531 Medium 1.6.51
CVE-2021-24531 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Stored Cross-Site Scripting

Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting

CVE-2024-10876 Medium 1.8.3.1
CVE-2024-10876 Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Cross-Site Scripting

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
17 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
2 critical and 1 high severity finding.
Recent CVEs
CVE-2026-10038, CVE-2026-7619 and CVE-2026-3177
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

CVE-2026-3177 Medium Patch path listed

CVE-2026-3177: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions...

Published
Apr 06, 2026
Patch Status
1.8.10
Review CVE-2026-3177 affected versions
Known Vulnerabilities

Reports for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-10038
CVE-2026-10038: Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the p...

Published
Jun 05, 2026
Patched Release
1.8.11.2
Affected Versions
Versions up to 1.8.11.1
Next Step
Update to 1.8.11.2 or newer if supported.
Review CVE-2026-10038 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-7619
CVE-2026-7619: Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 1.8.10.4 due to insufficient escaping on the user supplied paramete...

Published
May 12, 2026
Patched Release
1.8.10.5
Affected Versions
Versions up to 1.8.10.4
Next Step
Update to 1.8.10.5 or newer if supported.
Review CVE-2026-7619 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-3177
CVE-2026-3177: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incomi...

Published
Apr 06, 2026
Patched Release
1.8.10
Affected Versions
Versions up to 1.8.9.7
Next Step
Update to 1.8.10 or newer if supported.
Review CVE-2026-3177 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11893
CVE-2025-11893: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied paramete...

Published
Oct 24, 2025
Patched Release
1.8.8.5
Affected Versions
Versions up to 1.8.8.4
Next Step
Update to 1.8.8.5 or newer if supported.
Review CVE-2025-11893 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5275
CVE-2025-5275: Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and...

Published
Jun 25, 2025
Patched Release
1.8.6.2
Affected Versions
Versions up to 1.8.6.1
Next Step
Update to 1.8.6.2 or newer if supported.
Review CVE-2025-5275 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-47520
CVE-2025-47520: Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

Published
May 07, 2025
Patched Release
1.8.5.2
Affected Versions
Versions up to 1.8.5.1
Next Step
Update to 1.8.5.2 or newer if supported.
Review CVE-2025-47520 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-30770
CVE-2025-30770: Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i...

Published
Mar 26, 2025
Patched Release
1.8.4.8
Affected Versions
Versions up to 1.8.4.7
Next Step
Update to 1.8.4.8 or newer if supported.
Review CVE-2025-30770 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-10876
CVE-2024-10876: Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and...

Published
Nov 08, 2024
Patched Release
1.8.3.1
Affected Versions
Versions up to 1.8.3
Next Step
Update to 1.8.3.1 or newer if supported.
Review CVE-2024-10876 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-8791
CVE-2024-8791: Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID param...

Published
Sep 23, 2024
Patched Release
1.8.1.15
Affected Versions
Versions up to 1.8.1.14
Next Step
Update to 1.8.1.15 or newer if supported.
Review CVE-2024-8791 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37506
CVE-2024-37506: Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation

The Charitable plugin for WordPress is vulnerable to unauthorized access due to insufficient verification on the process_donation() function in versions up to, and including, 1.8.1.7. This makes it possible for unauthenticated attackers to donate on forms they shouldn't have acce...

Published
Jul 04, 2024
Patched Release
1.8.1.8
Affected Versions
Versions up to 1.8.1.7
Next Step
Update to 1.8.1.8 or newer if supported.
Review CVE-2024-37506 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37510
CVE-2024-37510: Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()

The Charitable plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_license_check function in versions up to, and including, 1.8.1.7. This makes it possible for unauthenticated attackers to verify a license.

Published
Jul 04, 2024
Patched Release
1.8.1.8
Affected Versions
Versions up to 1.8.1.7
Next Step
Update to 1.8.1.8 or newer if supported.
Review CVE-2024-37510 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47816
CVE-2023-47816: Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.7.0.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

Published
Oct 11, 2023
Patched Release
1.7.0.14
Affected Versions
Versions before 1.7.0.14
Next Step
Update to 1.7.0.14 or newer if supported.
Review CVE-2023-47816 fixed version details Open CVE Reference