VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 15 known issues Latest disclosed Apr 06, 2026

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Vulnerabilities

Review known vulnerability records for the WordPress plugin Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (`charitable`), including severity, CVE references, affected versions, and patch status.

View on WordPress.org Back to Feed
Known Records
15
High or Critical
3
Linked CVEs
14
Last Updated
Apr 06, 2026
Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More so operators can quickly confirm whether a disclosed issue maps to the installed slug and version range.

Patch Visibility
15 records include a published patch path.
Severity Mix
2 critical and 1 high severity finding.
Reference Workflow
Jump from the hub into the full report when you need remediation notes, CVSS vector details, or source references.
Known Vulnerabilities

Reports for Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-3177
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 1.8.9.7. This is due to missing cryptographic verification of incomi...

Published
Apr 06, 2026
Patched Release
1.8.10
Affected Versions
Versions up to 1.8.9.7
Next Step
Update to 1.8.10 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied paramete...

Published
Oct 24, 2025
Patched Release
1.8.8.5
Affected Versions
Versions up to 1.8.8.4
Next Step
Update to 1.8.8.5 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and...

Published
Jun 25, 2025
Patched Release
1.8.6.2
Affected Versions
Versions up to 1.8.6.1
Next Step
Update to 1.8.6.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-47520
Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to...

Published
May 07, 2025
Patched Release
1.8.5.2
Affected Versions
Versions up to 1.8.5.1
Next Step
Update to 1.8.5.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-30770
Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to i...

Published
Mar 26, 2025
Patched Release
1.8.4.8
Affected Versions
Versions up to 1.8.4.7
Next Step
Update to 1.8.4.8 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-10876
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and...

Published
Nov 08, 2024
Patched Release
1.8.3.1
Affected Versions
Versions up to 1.8.3
Next Step
Update to 1.8.3.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-8791
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID param...

Published
Sep 23, 2024
Patched Release
1.8.1.15
Affected Versions
Versions up to 1.8.1.14
Next Step
Update to 1.8.1.15 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37506
Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation

The Charitable plugin for WordPress is vulnerable to unauthorized access due to insufficient verification on the process_donation() function in versions up to, and including, 1.8.1.7. This makes it possible for unauthenticated attackers to donate on forms they shouldn't have acce...

Published
Jul 04, 2024
Patched Release
1.8.1.8
Affected Versions
Versions up to 1.8.1.7
Next Step
Update to 1.8.1.8 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-37510
Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()

The Charitable plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_license_check function in versions up to, and including, 1.8.1.7. This makes it possible for unauthenticated attackers to verify a license.

Published
Jul 04, 2024
Patched Release
1.8.1.8
Affected Versions
Versions up to 1.8.1.7
Next Step
Update to 1.8.1.8 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-47816
Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 1.7.0.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

Published
Oct 11, 2023
Patched Release
1.7.0.14
Affected Versions
Versions before 1.7.0.14
Next Step
Update to 1.7.0.14 or newer if supported.
Open Full Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-4404
Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation

The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user ro...

Published
Aug 17, 2023
Patched Release
1.7.0.13
Affected Versions
Versions up to 1.7.0.12
Next Step
Update to 1.7.0.13 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2022-47441
Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting

The Charitable plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.7.0.10 due to insufficient input sanitization and output escaping on the 'start_date_from', 'start_date_to', 'end_date_from', and 'end_date_to' parameters. This...

Published
Apr 19, 2023
Patched Release
1.7.0.11
Affected Versions
Versions up to 1.7.0.10
Next Step
Update to 1.7.0.11 or newer if supported.
Open Full Report Open CVE Reference