Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)

80 Quality Score

Active Installs

18/30

10,000 active installs is modest compared to GiveWP's 100,000, so Charitable sits in the mid-tier for adoption despite a strong overall quality score.

Update Freshness

25/25

Last updated June 2026 with a required PHP 7.4 floor and tested against WordPress 7.0, indicating the developer is actively shipping against current core releases.

User Rating

15/15

A 98 out of 100 from 211 ratings is exceptional and suggests the existing user base is highly satisfied with both features and stability.

Support Health

8/15

Only 3 support threads exist in the data, all resolved, which gives a perfect resolution rate but also means the sample size is too small to draw strong conclusions about long-term support responsiveness.

WP Compatibility

15/15

Full marks here, reflecting the modern PHP 7.4 requirement and confirmed testing with WordPress 7.0.

Scores higher than 79% of indexed plugins

About

The best WordPress donation plugin. Create fundraising donation forms, accept recurring donations, easy donor management, add crowdfunding, and more.

Active Installs 10k+

Rating ★★★★½ 4.9/5

Last Updated 2026-08-28 12:25pm GMT

Requires WordPress 5.9+

Tested Up To 7.1

Requires PHP 7.4+

Security History

22 known vulnerabilities, all patched

2 Critical 1 High 19 Medium

Most recent: August 31, 2026

View details ▸

Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute Medium

August 31, 2026 Patched in ["1.8.12.2"] CVE-2026-77189

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection Medium

August 31, 2026 Patched in ["1.8.12.2"] CVE-2026-81287

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.11.3 - Missing Authorization Medium

August 18, 2026 Patched in ["1.8.12"] CVE-2026-73994

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.12 - Unauthenticated Donation Payment Bypass Medium

August 14, 2026 Patched in ["1.8.12"] CVE-2026-16650

Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

August 2, 2026 Patched in ["1.8.5.3"] CVE-2025-15675

Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter Medium

June 5, 2026 Patched in ["1.8.11.2"] CVE-2026-10038

Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter Medium

May 12, 2026 Patched in ["1.8.10.5"] CVE-2026-7619

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook Medium

April 6, 2026 Patched in ["1.8.10"] CVE-2026-3177

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection Medium

October 24, 2025 Patched in ["1.8.8.5"] CVE-2025-11893

Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings Medium

June 25, 2025 Patched in ["1.8.6.2"] CVE-2025-5275

Charitable <= 1.8.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

May 7, 2025 Patched in ["1.8.5.2"] CVE-2025-47520

Charitable <= 1.8.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

March 26, 2025 Patched in ["1.8.4.8"] CVE-2025-30770

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting Medium

November 8, 2024 Patched in ["1.8.3.1"] CVE-2024-10876

Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation Critical

September 23, 2024 Patched in ["1.8.1.15"] CVE-2024-8791

Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation Medium

July 4, 2024 Patched in ["1.8.1.8"] CVE-2024-37506

Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check() Medium

July 4, 2024 Patched in ["1.8.1.8"] CVE-2024-37510

Charitable <= 1.7.0.13 - Authenticated(Contributor+) Stored Cross-Site Scripting Medium

October 11, 2023 Patched in ["1.7.0.14"] CVE-2023-47816

Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation Critical

August 17, 2023 Patched in ["1.7.0.13"] CVE-2023-4404

Charitable <= 1.7.0.10 - Reflected Cross-Site Scripting Medium

April 19, 2023 Patched in ["1.7.0.11"] CVE-2022-47441

Charitable – Donation Plugin <= 1.6.50 - Authenticated Stored Cross-Site Scripting Medium

July 21, 2021 Patched in ["1.6.51"] CVE-2021-24531

Charitable – Donation Plugin <= 1.6.50 - Unauthenticated Stored Cross-Site Scripting High

July 21, 2021 Patched in ["1.6.51"]

Charitable <= 1.5.13 - Unauthorized Access to Information Disclosure Medium

May 16, 2018 Patched in ["1.5.14"] CVE-2018-21011

What It Does

Charitable is a WordPress donation plugin that lets nonprofits and fundraisers create donation forms, accept one-time and recurring contributions, and manage donors directly from the WordPress dashboard. It covers the typical fundraising workflow: form building, payment processing via gateways like Stripe and PayPal, donor records, and email receipts.

Who It's For

This plugin fits small to mid-sized nonprofits, religious organizations, schools, community projects, and individual fundraisers who want a self-contained donation system without wiring together multiple tools. It is especially useful if you need recurring donations and want donor management built in rather than bolted on through other plugins.

Who Should Skip It

If you already run donations through WooCommerce and prefer to keep everything in that ecosystem, Donation Platform for WooCommerce is a tighter fit. Large charities expecting high-volume traffic, peer-to-peer campaigns, or advanced CRM integrations should look at GiveWP, which has a much larger install base and extension marketplace.

The Bottom Line

Charitable is a well-maintained, highly rated fundraising plugin that punches above its install count, earning an 80.11 quality score thanks to strong maintenance and compatibility signals. The main caveat is community size: with only 10,000 installs and a tiny public support thread count, you are betting on a smaller ecosystem than GiveWP offers. If recurring donations and built-in donor management are your priority and you are comfortable with a focused, premium-leaning plugin, it is a solid choice.

Pick GiveWP if you need a much larger extension ecosystem, more gateway options, and a plugin with 100,000 installs backing its longevity.

Donation Platform for WooCommerce: Fundraising & Donation Management 84/100

Choose this if your site already runs WooCommerce and you want donations handled through the same orders, tax, and reporting system you use for products.

Donations via PayPal 81/100

Pick this if all you need is a simple PayPal button and you want to avoid the overhead of a full fundraising suite.

Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More 78/100

Choose Better Payment if you want a lighter, payment-form-first approach with subscriptions rather than a donor management focus.

Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management 77/100

Pick Paymattic if you want a broader payment form builder that includes donations alongside other paid forms like bookings or event tickets.