High
CVE-2026-104394
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 24
Reset filters
Medium
CVE-2026-77189
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
Medium
CVE-2026-81287
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-73994
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization
Medium
CVE-2026-16650
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass
Medium
CVE-2025-15675
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-7558
Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter
Medium
CVE-2026-10038
Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
Medium
CVE-2026-7619
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
Medium
CVE-2026-3177
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook
Medium
CVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Medium
CVE-2025-47520
Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-30770
Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-10876
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting
Critical
CVE-2024-8791
Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation
Medium
CVE-2024-37510
Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()
Medium
CVE-2024-37506
Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation
Medium
CVE-2023-47816
Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting
Critical
CVE-2023-4404
Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation
Medium
CVE-2022-47441
Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting
High
f8aa8dd6-abff-4c37-98d5-39a924b15651
Charitable – Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2021-24531
Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting
Medium
CVE-2018-21011
Charitable <= 1.5.13 - Unauthorized Access to Information Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.