Charitable - Donation Plugin < 1.6.51 - Unauthenticated Stored Cross-Site Scripting

While fixing an Authenticated Stored Cross-Site Scripting issue https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f, the vendor identified another Cross-Site Scripting issue, which could be exploited by unauthenticated users and would be triggered in the context of a logged in...

WordPress Charitable plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Muhammad Daffa in WordPress Charitable plugin versions = 1.6.50. Solution Update the WordPress Charitable plugin to the latest available version at least 1.6.51...

Charities and the advertising industry: data ecosystems and privacy risks

Data makes the world go round, more often than not via advertising and its tracking mechanisms. Whether you think making money from large volumes of PII to keep the web ticking over is a good thing, or a sleazy data-grab often encouraging terrible ad practices, it’s not going to go away anytime...

Hurricane-Related Scams

June 1 marks the official start of the 2020 Atlantic hurricane season. The Cybersecurity and Infrastructure Security Agency CISA warns users to remain on alert for malicious cyber activity targeting potential disaster victims and charitable donors following a hurricane. Fraudulent emails—often...

WordPress charitable plugin information disclosure vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. charitable is used in one of the online donation platform to build plug-ins. An information disclosure vulnerability exists in the...

CVE-2018-21011

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...

CVE-2018-21011

CVE-2018-21011 affects the WordPress Charitable plugin prior to version 1.5.14, allowing unauthorized access to user and donation details. The issue stems from a vulnerability in the Charitable plugin that leads to information disclosure; CVSS metrics indicate a network-accessible flaw with mediu...

CVE-2018-21011: Exposure of Sensitive Information to an Unauthorized Actor

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...

PT-2019-10436

Name of the Vulnerable Software and Affected Versions Charitable plugin versions prior to 1.5.14 Description The issue allows for unauthorized access to user and donation details. Recommendations For versions prior to 1.5.14, update to version 1.5.14 or later to resolve the issue...

El Paso and Dayton Tragedy-Related Scams and Malware Campaigns

In the wake of the recent shootings in El Paso, TX, and Dayton, OH, the Cybersecurity and Infrastructure Security Agency CISA advises users to watch out for possible malicious cyber activity seeking to capitalize on these tragic events. Users should exercise caution in handling emails related to...

Nonprofits on Facebook Get Hacked—Then They Really Need Help

Facebook is an enormous platform for charitable giving, but some nonprofit leaders say there aren’t enough resources when something goes wrong...

Charitable <= 1.5.13 - Unauthorised Access

From the vendor blog pos details: Fix a bug that can in certain scenarios allow unauthorized users to access the user and donation details of previous donations. Payment details such as credit card details were not exposed...

WordPress Charitable plugin <= 1.5.13 - Unauthorized Access vulnerability leading to Sensitive Information Disclosure

Unauthorized Access vulnerability leading to Sensitive Information Disclosure discovered in WordPress Charitable plugin versions = 1.5.13. Solution Update the WordPress Charitable plugin to the latest available version at least 1.5.14...

A Top Employer in Canada for the Second Year in a Row

Trend Micro has been protecting governments, businesses and consumers from cyber-threats for more than 28 years. Right from the start, our founders were keen to emphasize the important role played by corporations in society as a whole. To that end, we’ve always been an active participant in...

IC3 Issues Alert on Disaster-Related Fraud

The Internet Crime Complaint Center IC3 has released an announcement on fraudulent cyber activity related to natural disasters. IC3 reports that scammers have recently used email and social-networking sites to solicit money from disaster victims with scams on false temporary housing and job...

Easter Holiday Phishing Scams and Malware Campaigns

As the Easter holiday approaches, US-CERT reminds users to stay aware of holiday scams and cyber campaigns, which may include: unsolicited shipping notifications that may actually be scams by attackers to solicit personal information phishing scams, electronic greeting cards that may contain...

Potential Hurricane Matthew Phishing Scams

US-CERT warns users to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Matthew. Users are advised to exercise caution in handling any email with subject line, attachments, or hyperlinks related to Hurricane Matthew, even if it appears to originate from ...

Easter Holiday Phishing Scams and Malware Campaigns

As the Easter holiday approaches, US-CERT reminds users to stay aware of holiday scams and cyber campaigns, which may include: shipping notifications that may be phishing scams or may contain malware electronic greeting cards that may contain malware requests for charitable contributions that may...

Holiday Season Phishing Scams and Malware Campaigns

As the winter holidays approach, US-CERT reminds users to stay aware of seasonal scams and cyber campaigns, which may include: electronic greeting cards that may contain malware requests for charitable contributions that may be phishing scams and may originate from illegitimate sources claiming t...