What’s Vulnerable › Products
smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More vulnerabilities
13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.
Latest smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More vulnerabilities
- CVE-2026-10038 — Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter (CVSS 4.3)
- CVE-2026-7619 — Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter (CVSS 6.5)
- CVE-2026-3177 — Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook (CVSS 5.3)
- CVE-2025-11893 — Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- CVE-2024-10876 — Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2024-37510 — WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2024-37506 — WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2024-8791 — Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation (CVSS 9.8)
- CVE-2023-47816 — WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-4404 — Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation (CVSS 9.8)
- CVE-2022-47441 — WordPress Charitable Plugin <= 1.7.0.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
- CVE-2021-24531 — Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS) (CVSS 5.4)
- CVE-2018-21011 — (CVSS 7.5)