Total Donations Plugin for WordPress < 2.0.6 - Arbitrary Options Update

Incorrect access control in miglaajaxfunctions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call...

CVE-2026-78570

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

CVE-2026-78570

...

EUVD-2026-65358

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-78570

...

CVE-2026-78570

CVE-2026-78570 was rejected as issued in error, but connected documents (EUVD-2026-65358, PT-2026-81249) describe the underlying issue: the Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.5 , allowing unauthenticated attackers to ...

CVE-2026-78568

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...

EUVD-2026-65324

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2026-78568

...

CVE-2026-78568

...

CVE-2026-78568

CVE-2026-78568 covers a SQL Injection vulnerability in the Total Donations plugin for WordPress , affecting all versions up to and including 2.0.5 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of proper preparation of the existing SQL query, allowing ...

CVE-2026-73390

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

CVE-2026-73391

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

EUVD-2026-62392

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

CVE-2026-73391

The WordPress Total Donations plugin (≤2.0.5) has an unauthenticated SQL Injection vulnerability rated CVSS 9.3 Critical. Patchstack reported it; no patch version or in-the-wild exploitation details are provided in the documents.

CVE-2026-73391 WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...

CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

EUVD-2026-62391

Unauthenticated Privilege Escalation in Total Donations = 2.0.5 versions...

CVE-2026-73390

The Total Donations WordPress plugin (versions ≤ 2.0.5) has an unauthenticated privilege escalation vulnerability allowing network attackers to gain elevated access without credentials. CVSS 9.8 (Critical) reflects high confidentiality, integrity, and availability impact. No root cause, patch ver...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...