CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-32519 – WordPress IDonate plugin <= 2.1.8 - Local File Inclusion vulnerability
https://notcve.org/view.php?id=CVE-2025-32519
09 Apr 2025 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonate allows PHP Local File Inclusion. This issue affects IDonate: from n/a through 2.1.8. The IDonate plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be... • https://patchstack.com/database/wordpress/plugin/idonate/vulnerability/wordpress-idonate-plugin-2-1-8-local-file-inclusion-vulnerability?_s_id=cve • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3594 – IDonate <= 1.9.0 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2024-3594
01 May 2024 — The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) El complemento IDonate WordPress hasta la versión 1.9.0 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Cross-Site Scri... • https://wpscan.com/vulnerability/7a8a834a-e5d7-4678-9d35-4390d1200437 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •