themeatelier IDonate – Blood Donation, Request And Donor Management System vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Latest themeatelier IDonate – Blood Donation, Request And Donor Management System vulnerabilities

CVE-2025-4521 — IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function (CVSS 8.8)
CVE-2025-67583 — WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability (CVSS 5.3)
CVE-2025-12877 — IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 5.3)
CVE-2025-4522 — IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function (CVSS 6.5)
CVE-2025-4519 — IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function (CVSS 8.8)
CVE-2025-11154 — IDonate < 2.1.13 - Unauthenticated User Deletion (CVSS 5.4)
CVE-2025-4523 — IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function (CVSS 6.5)
CVE-2025-32519 — WordPress IDonate plugin <= 2.1.18 - Local File Inclusion vulnerability (CVSS 9.8)
CVE-2024-3594 — IDonate <= 1.9.0 - Admin+ Stored XSS (CVSS 8.7)