Cross-Site Scripting
8 records47.1%First: 2021. Latest: 2025.
Plugin security history
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 17 vulnerability records associated with Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns), published between 2018 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
17Total records
2Critical
1High
14Medium
0Low
0Informational
17Patched records
0Currently marked unpatched
2018-05-16First disclosure
2026-06-05Latest disclosure
16 of 17CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2018 | 1 | |
| 2021 | 2 | |
| 2023 | 3 | |
| 2024 | 4 | |
| 2025 | 4 | |
| 2026 | 3 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 2 | 11.8% |
| High | 1 | 5.9% |
| Medium | 14 | 82.4% |
Vulnerability-Type Breakdown
Missing Authorization
5 records29.4%First: 2018. Latest: 2026.
SQL Injection
2 records11.8%First: 2025. Latest: 2026.
Privilege Escalation
1 record5.9%First: 2023. Latest: 2023.
Other
1 record5.9%First: 2026. Latest: 2026.
Patch Status
- Patched
- 17
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
1.8.11.21.8.10.51.8.101.8.8.51.8.6.21.8.5.21.8.4.81.8.3.11.8.1.151.8.1.81.7.0.141.7.0.131.7.0.111.6.511.5.14
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-1.8.11.1 | Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter | June 5, 2026 | 1.8.11.2 | Medium |
*-1.8.10.4 | Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter | May 12, 2026 | 1.8.10.5 | Medium |
*-1.8.9.7 | Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook | April 6, 2026 | 1.8.10 | Medium |
*-1.8.8.4 | Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection | October 24, 2025 | 1.8.8.5 | Medium |
*-1.8.6.1 | Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings | June 25, 2025 | 1.8.6.2 | Medium |
*-1.8.5.1 | Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting | May 7, 2025 | 1.8.5.2 | Medium |
*-1.8.4.7 | Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting | March 26, 2025 | 1.8.4.8 | Medium |
*-1.8.3 | Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting | November 8, 2024 | 1.8.3.1 | Medium |
*-1.8.1.14 | Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation | September 23, 2024 | 1.8.1.15 | Critical |
*-1.8.1.7 | Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check() | July 4, 2024 | 1.8.1.8 | Medium |
*-1.8.1.7 | Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation | July 4, 2024 | 1.8.1.8 | Medium |
[*, 1.7.0.14) | Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting | October 11, 2023 | 1.7.0.14 | Medium |
*-1.7.0.12 | Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation | August 17, 2023 | 1.7.0.13 | Critical |
*-1.7.0.10 | Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting | April 19, 2023 | 1.7.0.11 | Medium |
*-1.6.50 | Charitable – Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting | July 21, 2021 | 1.6.51 | High |
*-1.6.50 | Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting | July 21, 2021 | 1.6.51 | Medium |
[*, 1.5.14) | Charitable <= 1.5.13 - Unauthorized Access to Information Disclosure | May 16, 2018 | 1.5.14 | Medium |
Selected source records
Latest Records
MediumCVE-2026-10038
Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
Published: June 5, 2026
- Affected versions
- *-1.8.11.1
- Patched versions
- 1.8.11.2
MediumCVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Published: May 12, 2026
- Affected versions
- *-1.8.10.4
- Patched versions
- 1.8.10.5
MediumCVE-2026-3177
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
Published: April 6, 2026
- Affected versions
- *-1.8.9.7
- Patched versions
- 1.8.10
MediumCVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
Published: October 24, 2025
- Affected versions
- *-1.8.8.4
- Patched versions
- 1.8.8.5
MediumCVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Published: June 25, 2025
- Affected versions
- *-1.8.6.1
- Patched versions
- 1.8.6.2
MediumCVE-2025-47520
Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published: May 7, 2025
- Affected versions
- *-1.8.5.1
- Patched versions
- 1.8.5.2
MediumCVE-2025-30770
Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: March 26, 2025
- Affected versions
- *-1.8.4.7
- Patched versions
- 1.8.4.8
MediumCVE-2024-10876
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting
Published: November 8, 2024
- Affected versions
- *-1.8.3
- Patched versions
- 1.8.3.1
Highest-Severity Records
CriticalCVE-2024-8791
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
Published: September 23, 2024
- Affected versions
- *-1.8.1.14
- Patched versions
- 1.8.1.15
CriticalCVE-2023-4404
Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation
Published: August 17, 2023
- Affected versions
- *-1.7.0.12
- Patched versions
- 1.7.0.13
High
Charitable – Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting
Published: July 21, 2021
- Affected versions
- *-1.6.50
- Patched versions
- 1.6.51
MediumCVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
Published: October 24, 2025
- Affected versions
- *-1.8.8.4
- Patched versions
- 1.8.8.5
MediumCVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Published: May 12, 2026
- Affected versions
- *-1.8.10.4
- Patched versions
- 1.8.10.5
MediumCVE-2021-24531
Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting
Published: July 21, 2021
- Affected versions
- *-1.6.50
- Patched versions
- 1.6.51
MediumCVE-2025-30770
Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: March 26, 2025
- Affected versions
- *-1.8.4.7
- Patched versions
- 1.8.4.8
MediumCVE-2023-47816
Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting
Published: October 11, 2023
- Affected versions
- [*, 1.7.0.14)
- Patched versions
- 1.7.0.14
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.