WordPress plugin
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 23 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High2
- Medium19
- Low0
All Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.8.12.3Update to 1.8.13
- Medium6.5Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
≤1.8.12.1Update to 1.8.12.2
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.8.12.1Update to 1.8.12.2
- Medium5.3Missing Authorization
≤1.8.11.3Update to 1.8.12
- Medium5.3Unauthenticated Donation Payment Bypass
<1.8.12Update to 1.8.12
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
<1.8.5.3Update to 1.8.5.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
≤1.8.11.1Update to 1.8.11.2
- Medium6.5Authenticated (Custom+) SQL Injection via 's' Search Parameter
≤1.8.10.4Update to 1.8.10.5
- Medium5.3Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
≤1.8.9.7Update to 1.8.10
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.8.8.4Update to 1.8.8.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
≤1.8.6.1Update to 1.8.6.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.8.5.1Update to 1.8.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.8.4.7Update to 1.8.4.8
- Medium6.1Reflected Cross-Site Scripting
≤1.8.3Update to 1.8.3.1
- Critical9.8Insecure Direct Object Reference to Account Takeover and Privilege Escalation
≤1.8.1.14Update to 1.8.1.15
- Medium5.3Missing Authorization to Unauthorized Donation
≤1.8.1.7Update to 1.8.1.8
- Medium5.3Missing Authorization via ajax_license_check()
≤1.8.1.7Update to 1.8.1.8
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
<1.7.0.14Update to 1.7.0.14
- Critical9.8Unauthenticated Privilege Escalation
≤1.7.0.12Update to 1.7.0.13
- Medium6.1Reflected Cross-Site Scripting
≤1.7.0.10Update to 1.7.0.11
- Medium6.4Authenticated Stored Cross-Site Scripting
≤1.6.50Update to 1.6.51
- High7.2Unauthenticated Stored Cross-Site Scripting
≤1.6.50Update to 1.6.51
- Medium5.3Unauthorized Access to Information Disclosure
<1.5.14Update to 1.5.14
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns): common questions
Does Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) have known vulnerabilities?
Yes. VulnCrest Radar lists 23 known vulnerabilities in Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns): 2 critical, 2 high, 19 medium. None are known to affect version null.
How do I check which version of Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) vulnerability?
CVE-2026-104394, published Oct 5, 2026: Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.3 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) vulnerability listed in CISA KEV?
No. None of the known Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) vulnerabilities is currently listed in the CISA KEV catalog.