6.5 Medium

CVE-2025-11893 The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is…

Description

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation of the vulnerability requires a paid donation.

Affected products and versions

Product	Affected versions	Fixed in
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More 1.8	earliest → 1.8.8.4	No fix stated

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org

Timeline

Published October 25, 2025
Last modified April 8, 2026

The 8 CVEs of Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More →

CVE-2026-10038 The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is… 4.3 Medium CVE-2026-7619 The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is… 6.5 Medium CVE-2026-3177 The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is… 5.3 Medium CVE-2025-5275 The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is… 4.4 Medium

Track this CVE