What’s Vulnerable › Vulnerabilities

CVE-2021-24531: Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-23 · updated 2026-06-17
• Weakness: CWE-79

Description

The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.

Affected products

• smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More: before 1.6.51 — fixed in 1.6.51

How to fix

Upgrade to a fixed version: smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More 1.6.51. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f
• https://www.wpcharitable.com/release-notes-1-6-51/
• https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f
• https://www.wpcharitable.com/release-notes-1-6-51/

Get alerted when CVE-2021-24531 or the next vulnerability affects your stack