Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?IDonateIDonatePro
Plugin · idonate
IDonate
9 known vulnerabilities on record. Add your version above to see which ones affect you.
Feb 19, 2026IDonate – Blood Donation, Request And Donor Management System: Privilege EscalationCVE-2025-4521 · affects 2.1.5 to 2.1.9 · reported by WordfenceHigh 8.8
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_profile() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack any account by reassigning its email address (via the donor_id they supply) and then triggering a password reset, ultimately granting themselves full administrator privileges.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2025IDonate: Missing AuthorizationCVE-2025-67583 · affects up to 2.1.15 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.
Nov 22, 2025IDonate – Blood Donation, Request And Donor Management System: Unauthorized modification od dataCVE-2025-12877 · affects up to 2.1.15 · reported by WordfenceMedium 5.3
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts. CVE-2025-67583 is likely a duplicate of this.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 7, 2025IDonate – Blood Donation, Request And Donor Management System: Insecure Direct Object ReferenceCVE-2025-4522 · affects 2.0.0 to 2.1.9 · reported by WordfenceMedium 6.5
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the admin_post_donor_delete() function in versions 2.0.0 to 2.1.9. By supplying an arbitrary user_id parameter value to the wp_delete_user() function, authenticated attackers, with Subscriber-level access and above could delete arbitrary user accounts, including those of administrators.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 7, 2025IDonate – Blood Donation, Request And Donor Management System: Privilege EscalationCVE-2025-4519 · affects 2.1.5 to 2.1.9 · reported by WordfenceHigh 8.8
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_password() function in versions 2.1.5 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate a password reset for any user (including administrators) and elevate their privileges for full site takeover.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2025IDonate: Does not have authorisation and CSRFCVE-2025-11154 · fixed in 2.1.13 · reported by WPScanMedium 5.4
The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.
Aug 1, 2025IDonate – Blood Donation, Request And Donor Management System: Unauthorized access of dataCVE-2025-4523 · affects 2.0.0 to 2.1.9 · reported by WordfenceMedium 6.5
The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view() function in versions 2.0.0 to 2.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose an administrator’s username, email address, and all donor fields.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 11, 2025IDonate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32519 · affects up to 2.1.18 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Foysal Imran IDonate idonate allows PHP Local File Inclusion.This issue affects IDonate: from n/a through <= 2.1.18.
May 23, 2024IDonate: Does not sanitise and escape some of its settingsCVE-2024-3594 · affects up to 1.9.0 · reported by WPScanHigh 8.7
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.