IDonate – Blood Donation, Request And Donor Management System

Software Type	Plugin
Software Slug	idonate (view on wordpress.org)
Software Status	Active
Software Author	faysal61
Software Website	idonate.fixolab.com
Software Downloads	12,549
Software Active Installs	30
Software Record Last Updated	August 10, 2026

9 Vulnerabilities

Submit a Vulnerability

IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function

8.8

CVE-2025-4521

Feb 18, 2026

Researcher: kr0d

IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

5.3

CVE-2025-12877

Nov 21, 2025

Researcher: Varakorn Chanthasri (iCreaM)

IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function

6.5

CVE-2025-4522

Nov 6, 2025

Researcher: kr0d

IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function

8.8

CVE-2025-4519

Nov 6, 2025

Researcher: kr0d

IDonate < 2.1.13 - Missing Authorization

5.3

CVE-2025-11154

Oct 28, 2025

Researcher: Khaled Alenazi (Nxploited)

IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function

6.5

CVE-2025-4523

Jul 31, 2025

Researcher: kr0d

IDonate <= 2.1.9 - Unauthenticated Local File Inclusion

9.8

CVE-2025-32519

Apr 9, 2025

Researcher: Dimas Maulana

IDonate – blood request management system <= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-3594

May 1, 2024

Researcher: Laburity Research Team

Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout

4.3

CVE-2024-32110

Apr 11, 2024

Researcher: Dhabaleshwar Das

Title	Status	CVE ID	CVSS	Researchers	Date
IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function	Patched	CVE-2025-4521	8.8	kr0d	February 18, 2026
IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion	Patched	CVE-2025-12877	5.3	Varakorn Chanthasri (iCreaM)	November 21, 2025
IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function	Patched	CVE-2025-4522	6.5	kr0d	November 6, 2025
IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function	Patched	CVE-2025-4519	8.8	kr0d	November 6, 2025
IDonate < 2.1.13 - Missing Authorization	Patched	CVE-2025-11154	5.3	Khaled Alenazi (Nxploited)	October 28, 2025
IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function	Patched	CVE-2025-4523	6.5	kr0d	July 31, 2025
IDonate <= 2.1.9 - Unauthenticated Local File Inclusion	Unpatched	CVE-2025-32519	9.8	Dimas Maulana	April 9, 2025
IDonate – blood request management system <= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2024-3594	4.4	Laburity Research Team	May 1, 2024
Appsero <= 2.0.0 - Missing Authorization via handle_optin_optout	Unpatched	CVE-2024-32110	4.3	Dhabaleshwar Das	April 11, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation