WordPress Charitable plugin <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability

Authenticated Contributor+ SQL Injection via 'order' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Charitable versions = 1.8.12.1...

WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Charitable versions = 1.8.12.1...

CVE-2026-81287: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

PT-2026-84002

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...

CVE-2026-16650

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-16650

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in its default configuration. This allows unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment being made. The vulnerab...

CVE-2026-16650 Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

EUVD-2026-63910

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-16650 Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

PT-2026-79369

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-16650: Insufficient Verification of Data Authenticity

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...

CVE-2026-73994

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73994 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

EUVD-2026-60808

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73994 WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

CVE-2026-73994

CVE-2026-73994 is an unauthenticated Broken Access Control vulnerability in the WordPress Charitable plugin , affecting versions 1.8.11.3 and earlier . The flaw allows a remote attacker with no privileges to modify data, resulting in a high integrity impact (CVSS 3.1 score: 7.5 HIGH ). CISA's SSV...

WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Charitable versions = 1.8.11.3...

CVE-2026-73994: Missing Authorization

Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...

PT-2026-77122

Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...