Plugin icon

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)

charitable

Vulnerabilities:

18

Last Updated:

July 21, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-07-23
Title
Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
Fixed in
Fixed in 1.8.5.3
CVSS
3.5 (low)
Published
2026-06-05
Title
Charitable < 1.8.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
Fixed in
Fixed in 1.8.11.2
CVSS
4.3 (medium)
Published
2026-05-12
Title
Charitable < 1.8.10.5 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Fixed in
Fixed in 1.8.10.5
CVSS
6.5 (medium)
Published
2026-04-06
Title
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More < 1.8.10 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
Fixed in
Fixed in 1.8.10
CVSS
5.3 (medium)
Published
2025-10-24
Title
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More < 1.8.8.5 - Authenticated (Subscriber+) SQL Injection
Fixed in
Fixed in 1.8.8.5
CVSS
6.5 (medium)
Published
2025-06-25
Title
Charitable < 1.8.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Fixed in
Fixed in 1.8.6.2
CVSS
4.4 (medium)
Published
2025-05-07
Title
Charitable < 1.8.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.8.5.2
CVSS
4.4 (medium)
Published
2025-03-26
Title
Charitable < 1.8.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.8.4.8
CVSS
6.4 (medium)
Published
2024-11-08
Title
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More < 1.8.3.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.8.3.1
CVSS
6.1 (medium)
Published
2024-09-23
Title
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress < 1.8.1.15 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
Fixed in
Fixed in 1.8.1.15
CVSS
9.8 (critical)
Published
2024-07-04
Title
Charitable < 1.8.1.8 - Missing Authorization via ajax_license_check()
Fixed in
Fixed in 1.8.1.8
CVSS
5.3 (medium)
Published
2024-07-04
Title
Charitable < 1.8.1.8 - Missing Authorization to Unauthorized Donation
Fixed in
Fixed in 1.8.1.8
CVSS
5.3 (medium)
Published
2023-10-11
Title
Charitable < 1.7.0.14 - Authenticated(Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.7.0.14
CVSS
6.4 (medium)
Published
2023-08-22
Title
Donation Forms by Charitable < 1.7.0.13 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 1.7.0.13
CVSS
9.8 (critical)
Published
2023-04-19
Title
Charitable < 1.7.0.11 - Reflected XSS
Fixed in
Fixed in 1.7.0.11
CVSS
7.1 (high)
Published
2021-07-21
Title
Charitable - Donation Plugin < 1.6.51 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 1.6.51
CVSS
8.1 (high)
Published
2021-07-21
Title
Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 1.6.51
CVSS
3.8 (low)
Published
2018-05-16
Title
Charitable <= 1.5.13 - Unauthorised Access
Fixed in
Fixed in 1.5.14
CVSS
7.5 (high)