Charitable CVE-2026-104394

Exploitation requires that a WordPress site run the Charitable plugin at version 1.8.12.3 or earlier, and that an attacker induce a victim - typically a logged-in administrator or site visitor - to click a crafted link or load an attacker-influenced page (UI:R). No authentication is required of the attacker (PR:N), so the injection point is reachable by anonymous users, but successful payload execution depends on victim interaction and on the browser rendering the unsanitized input. The practical limiting factors are: the need for user interaction, the requirement that the plugin be installed and at a vulnerable version, and that impact is confined to the victim's browser session rather than the server. The specific vulnerable parameter/endpoint is not detailed in the available data and should be confirmed via the Patchstack advisory.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated flaw, but the UI:R requirement means an attacker must lure a victim (often a logged-in administrator) into triggering the payload, which caps real-world weaponization. The S:C (scope change) is standard for XSS, reflecting that the injected script executes in a victim's browser security context rather than the WordPress server itself; the resulting C:L/I:L impacts are session/DOM-level, not direct server compromise. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by plugin prevalence and the unauthenticated entry point, not by observed attacks. Note one inconsistency to verify: the CVSS vector includes A:L (availability impact), which is atypical for a classic reflected/stored XSS and may be an overstatement by the reporter; impact is more plausibly confidentiality/integrity only. Because the only reference is a single Patchstack advisory, affected-version detail and exploitation specifics should be confirmed against the vendor before high-urgency remediation decisions.

An attacker crafts a malicious link or submits attacker-controlled input to a vulnerable Charitable endpoint and tricks a site administrator or visitor into loading it; the page reflects or renders the unsanitized input, executing arbitrary JavaScript in the victim's browser. This can hijack the authenticated session, perform actions as the victim, or inject content into the donation pages. No public exploit code was identified at time of analysis, and the attack requires user interaction (UI:R), limiting mass automation.