Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
charitable · plugin
Known security vulnerabilities for Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns). Find out in seconds which version runs on your site with WP Lens.
18 known vulnerabilities
2 critical · 9 exploitable without logging in · latest Sep 1, 2026
Listed on wordpress.org · latest 1.8.13 · last updated Oct 1, 2026 · 10K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2024-8791unauthenticated≤ 1.8.1.14
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Priv
- Critical 9.8
CVE-2023-4404unauthenticated≤ 1.7.0.12
Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation
- High 8.5
CVE-2026-81287subscriber+≤ 1.8.12.1
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
- High 7.5
CVE-2026-73994unauthenticated≤ 1.8.11.3
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
- High 7.5
CVE-2018-21011unauthenticated
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.
- Medium 6.5
CVE-2024-37510unauthenticated≤ 1.8.1.7
WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability
- Medium 6.5
CVE-2026-7619login required≤ 1.8.10.4
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
- Medium 6.5
CVE-2025-11893subscriber+≤ 1.8.8.4
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
- Medium 6.5
CVE-2025-30770login required≤ 1.8.4.7
WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability
- Medium 6.5
CVE-2026-77189contributor+≤ 1.8.12.1
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
- Medium 6.1
CVE-2024-10876unauthenticated · needs a click≤ 1.8.3
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting
- Medium 6.1
CVE-2022-47441unauthenticated · needs a click≤ 1.7.0.10
WordPress Charitable Plugin <= 1.7.0.10 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.9
CVE-2025-47520high privilege≤ 1.8.5.1
WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) Vulnerability
- Medium 5.4
CVE-2023-47816login required≤ 1.7.0.13
WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.3
CVE-2026-3177unauthenticated≤ 1.8.9.7
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthen
- Medium 5.3
CVE-2024-37506unauthenticated≤ 1.8.1.7
WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability
- Medium 4.3
CVE-2026-10038subscriber+≤ 1.8.11.1
Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
- Medium 4.0
CVE-2025-5275admin≤ 1.8.6.1
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).