Wpcharitable Charitable vulnerabilities
6 vulnerabilities
Known vulnerabilities in Wpcharitable Charitable, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2018-21011wordpress · charitable +1 morewordpress charitableThe charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.EPSS1.73%MediumCVE-2021-24531unknown · charitable – donation plugin +2 moreCharitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.EPSS0.58%HighCVE-2022-47441charitable donations & fundraising team · donation forms by charitable +2 moreWordPress Charitable Plugin <= 1.7.0.10 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.10 versions.EPSS0.38%CriticalCVE-2024-8791smub · charitable – donation plugin for wordpress – fundraising with recurring donations & more +2 moreDonation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege EscalationThe Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.8.1.14. This is due to the plugin not properly verifying a user's identity when the ID parameter is supplied through the update_core_user() function. This makes it possible for unauthenticated attackers to update the email address and password of arbitrary user accounts, including administrators, which can then be used to log in to those user accounts.EPSS0.73%MediumCVE-2023-47816charitable donations & fundraising team · donation forms by charitable +2 moreWordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.EPSS0.44%CriticalCVE-2023-4404smub · charitable – donation plugin for wordpress – fundraising with recurring donations & more +2 moreDonation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege EscalationThe Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration.EPSS0.91%