Wpcharitable maintains the Charitable plugin for WordPress, a donation and fundraising tool that extends a widely used content-management platform. Vulnerabilities in this plugin skew strongly toward critical-severity outcomes and center on web-application weakness classes including cross-site scripting, authorization bypass, exposure of sensitive data, and improper privilege management—patterns characteristic of plugins that handle user input, access control, and financial transaction flows. Defenders should treat updates for this plugin as high-priority given the severity profile and the potential exposure of donor information and administrative functions; live exploitation status and current vulnerability counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpcharitable over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-8791CRITICAL The Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and inclu | Sep 24, 2024 | 9.8 | 30 | NO | NO |
CVE-2023-4404CRITICAL The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'updat | Aug 23, 2023 | 9.8 | 26 | NO | NO |
CVE-2018-21011HIGH The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details. | Sep 9, 2019 | 7.5 | 26 | NO | NO |
CVE-2022-47441MEDIUM Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.10 versions. | May 10, 2023 | 6.1 | 21 | NO | NO |
CVE-2021-24531MEDIUM The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation featur | Aug 23, 2021 | 5.4 | 18 | NO | NO |
CVE-2023-47816MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= | Nov 22, 2023 | 5.4 | 17 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpcharitable.
Media articles that mention a CVE ID that affects a product developed by Wpcharitable — matched by CVE ID, not by vendor name.