CVE-2024-3594

The CVE CVE-2024-3594 concerns the IDonate WordPress plugin (≤ 1.9.0). It states that certain settings are not sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite). Root cause: incomplete sanitization/escaping...

CVE-2025-11154

CVE-2025-11154 affects IDonate for WordPress, vulnerable in versions prior to 2.1.13 due to missing authorization and CSRF protection when deleting users via an action handler. This unauthenticated flow allows an attacker to delete arbitrary users. Reported across multiple sources (Wordfence, Pat...

CVE-2025-67583

CVE-2025-67583 concerns the WordPress IDonate plugin (ThemeAtelier IDonate) with a broken access control issue up to version 2.1.15. The vulnerability is described as a Missing Authorization vulnerability arising from incorrectly configured access control security levels in IDonate. Affected soft...

CVE-2025-12877

Proven vulnerability CVE-2025-12877 affects the WordPress plugin IDonate – Blood Donation, Request And Donor Management System, with all versions up to and including 2.1.15 susceptible to unauthorized modification of data due to a missing capability check in pending_blood_request_action(). This e...