This finding is what's known as a "false positive," i.e. not a true vulnerability.​ Blackbaud prevents clickjacking by setting frame response to same-origin.

Additional Resources:
How to troubleshoot failures of PCI scan reports
How to obtain a copy of PCI compliance certificates