Cryptocurrency Donation Box – Bitcoin & Crypto Donations
Cryptocurrency Donation Box – Bitcoin & Crypto Donations has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.
The most common weakness is Missing Authorization, behind 2 of the records (67%). Other recurring categories include SQL Injection.
2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.
3 independent researchers contributed these findings, one record each. Cryptocurrency Donation Box – Bitcoin & Crypto Donations is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2026-39691Cryptocurrency Donation Box – Bitcoin & Crypto Donations <= 2.2.13 - Missing Authorization
Read the full analysisVulnerability Records
Cryptocurrency Donation Box – Bitcoin & Crypto Donations
Author
AdAstraCrypto
🌟 CRYPTOCURRENCY DONATION BOX Accept cryptocurrency payments and cryptocurrency donations on your WordPress website using this free Cryptocurrency Payment and Donation Box crypto widget for WordPress. Add your wallet address and use the shortcode on any page, post, or sidebar – it can be placed anywhere on your site. [crypto-donation-box] 🌟 HOW TO USE Check out our tutorial video below: 🌟 PLUGIN FEATURES Accept payment from any cryptocurrency – Bitcoin, Ethereum, Bitcoin Cash, Litecoin, USDT, Cardano & many more… Accept payment from all different types of cryptowallet. Use QR codes for your wallet address to make crypto payments and donations quick and easy Enhance your WordPress site with our beautiful and heavily customizable crypto payment and donation box design. Add the [crypto-donation-box] shortcode anywhere on your site, including posts and sidebars. Use on-the-go! Our plugin is 100% Mobile friendly and reliable. Get started right away with our easy-to-use style settings. External Services This plugin interacts with the following third-party/external services to enable its features: MetaLocker Service Purpose: This service is used to manage plugin activation and validate API keys. Data Sent: Admin email is sent when the plugin is activated. Data Received: Activation status and API key validation response. Service Provider: MetaPlugins Service URL: https://metalocker.service.metaplugins.io Terms of Service: Link to ToS Privacy Policy: Link to Privacy Policy Binance Smart Chain Purpose: Fetches blockchain data for processing cryptocurrency payments. Data Sent: None directly from users; RPC nodes may log network requests (wallet address, etc.). Service URLs: Binance Smart Chain Mainnet: https://bsc-dataseed.binance.org/ Binance Smart Chain Testnet: https://data-seed-prebsc-1-s1.binance.org:8545/ Terms of Service: Binance ToS Privacy Policy: Binance Privacy Policy Nodesmith API Purpose: Used to interact with Ethereum-based networks for retrieving wallet and transaction data. Data Sent: Network requests may include wallet address, token data, and transaction info. Service URLs: Ethereum Mainnet: https://ethereum.api.nodesmith.io/v1/mainnet/jsonrpc Ethereum Ropsten Testnet: https://ethereum.api.nodesmith.io/v1/ropsten/jsonrpc Terms of Service: Nodesmith ToS Privacy Policy: Nodesmith Privacy Policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C