CVE-2026-104394

Unauthenticated Cross Site Scripting XSS in Charitable = 1.8.12.3 versions...

CVE-2026-104394

The Charitable plugin for WordPress , affecting versions

CVE-2026-104394 WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Charitable = 1.8.12.3 versions...

CVE-2026-77189

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

EUVD-2026-68983

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189 Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189

The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...

PT-2026-84118

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-77189: Improper Neutralization of Special Elements used in an SQL Command

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-81287

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

EUVD-2026-68777

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287 WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287

CVE-2026-81287 affects the WordPress Charitable plugin in versions 1.8.12.1 and earlier , where a subscriber-level SQL injection vulnerability exists. The flaw allows an authenticated subscriber to exploit a SQL injection, with a CVSS 3.1 score of 8.5 (HIGH) . The vector CVSS:3.1/AV:N/AC:L/PR:L/U...

WordPress Charitable plugin <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability

Authenticated Contributor+ SQL Injection via 'order' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Charitable versions = 1.8.12.1...

WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Charitable versions = 1.8.12.1...

PT-2026-84002

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

CVE-2026-81287: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...