Click & Pledge CONNECT

Click & Pledge CONNECT has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is SQL Injection, behind 2 of the records (100%).

Every one of the 2 issues recorded for Click & Pledge CONNECT has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Click & Pledge CONNECT is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
8.7/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Click & Pledge CONNECT vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-28983

Click & Pledge Connect <= 25.04010101-WP6.8 - Unauthenticated SQL Injection to Privilege Escalation

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv26.06000000-WP7.0

Click & Pledge CONNECT

ClickandPledge

Author

ClickandPledge

0.0(0)
0/100
Last Updated
2026-06-17 (3mo ago)
Active Installs
200+
Downloads
10,653
Requires WP
5.2+
Requires PHP
5.6+
Tested up to
WP 7.0.4
Created
2017-09-07 (9y ago)

The Click & Pledge CONNECT plugin brings your CONNECT donation forms and pledgeTV® channels directly into your WordPress site. With a simple shortcode, you can embed responsive, fully branded giving experiences on any page or post — no coding required. What you can do with CONNECT Organize your forms and pledgeTV® channels into groups, each with its own schedule. Assign start and end dates so the right form or video appears at the right time, automatically — no manual page edits needed. Display forms inline on the page or as an overlay triggered by a link, and use multiple shortcodes on a single page to offer donors different giving options side by side. Whether you’re running a seasonal campaign, rotating fundraising appeals, or embedding video fundraising alongside donation forms, the CONNECT plugin keeps everything in sync between your WordPress site and your Click & Pledge account. For more information please see: https://support.clickandpledge.com/hc/en-us/articles/36982886486811-CONNECT-WordPress-Plugin/ About Click & Pledge Click & Pledge began on May 30, 2000, with a simple but powerful question: What if online fundraising could be easier for everyone? What started as a small side project to help our local community quickly sparked a vision much larger than we ever imagined. We saw an opportunity not just to build software, but to transform the way nonprofits and donors connect. More than 25 years later, that vision has grown into a global platform serving over 20,000 organizations and powering more than $1 billion in charitable contributions. At Click & Pledge, we believe fundraising isn’t just a transaction, but a moment of human connection. That’s why we’re committed to reimagining the giving experience from the donor’s perspective, ensuring every interaction is intuitive, meaningful, and effective. From innovative fundraising tools to our comprehensive Academy, we empower nonprofits and partners to master both the technology and the human behavior behind successful giving. Please note: This plugin requires an active Click & Pledge account and an SSL-secured WordPress site. If you are not an existing account holder, you can apply at Click & Pledge. Please contact Support with any questions. Requirements   – An active Click & Pledge Account. If you are not an existing account holder please apply here. – Secure site – Your website domain name must have SSL configured & all request from http should redirect to https.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C