EUVD-2025-210588
GHSA-pwhm-f4mm-grcw
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
High privileges required (campaign-manager role); scope changes to victim browser; no availability impact; matches provided NVD vector.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page.
AnalysisAI
Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated users holding a high-privilege campaign-management role to inject persistent malicious scripts via an unsanitized campaign image text field that is rendered unescaped inside an HTML attribute on the public-facing campaign page. Any site visitor who loads that page becomes a potential victim, enabling session hijacking, credential theft, or defacement against the site's front-end audience. A publicly available proof-of-concept exploit exists; however, no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (6th percentile) reflects low broad-exploitation probability consistent with the high-privilege prerequisite.
Technical ContextAI
The Charitable plugin (CPE: cpe:2.3:a:unknown:charitable:*:*:*:*:*:*:*:*) is a WordPress donation and campaign-management extension. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied text intended for a campaign image descriptor is persisted to the database without server-side sanitization and is later rendered directly into an HTML attribute on the public campaign page without context-appropriate escaping (e.g., missing esc_attr() or equivalent WordPress sanitization hooks). Because the injection point sits inside an HTML attribute context rather than between tags, encoding gaps that allow quote-breaking or event-handler injection are the likely mechanism. The CVSS scope change (S:C) indicates the malicious payload executes in the victim's browser security context rather than the server's, which is characteristic of client-side XSS.
RemediationAI
The vendor has released a patch in Charitable version 1.8.5.3; site administrators should upgrade to 1.8.5.3 or any later release immediately via the WordPress plugin dashboard or by downloading from the official WordPress plugin repository. The advisory is detailed at https://wpscan.com/vulnerability/19381d34-3942-4ba6-92a9-0290e1006da0/. If immediate patching is not possible, a compensating control is to audit and restrict which users hold the campaign-management role, reducing the exploitable population to only fully trusted staff - note that this does not eliminate the vulnerability, only reduces exposure. Additionally, deploying a Web Application Firewall (WAF) rule blocking common XSS payloads in campaign image fields can provide partial mitigation, though WAF bypasses are common for attribute-context XSS. Content Security Policy (CSP) headers restricting inline script execution on campaign pages would significantly limit the impact of any successful injection even if payload delivery occurs.
More in Charitable
View allThe Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and inclu
The Donation Forms by Charitable - Donations Plugin & Fundraising Platform for WordPress plugin for WordPress is vulnera
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donatio
Webhook authentication bypass in the Charitable WordPress donation plugin (versions before 1.8.12) allows unauthenticate
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated
The Charitable - Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site script
The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vul
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today