Cryptocurrency Donation Box CVE-2026-93885

Exploitation requires that a public-facing page renders the [crypto-donation-box] shortcode, which both exposes the cdbbc_donation_box nonce in the wallets_data JavaScript object and makes the wp_ajax_nopriv_cdbbc_payment_verify action reachable by anonymous users - these are default behaviors wherever the donation box is published, so no non-default configuration is needed. No authentication is required (PR:N confirmed) and no victim interaction is needed to inject the payload. The practical limiting factor is the second-order nature of stored XSS: the injected script only fires when a logged-in user - typically an administrator - opens the plugin's donation list table in wp-admin, so impact is gated on that admin view occurring rather than on any attacker-controlled step.

This is a genuine, defensible priority within its (niche) deployment base, though not a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) is internally consistent with the description: the flaw is reachable over the network with low complexity and no privileges because the cdbbc_payment_verify handler is registered under wp_ajax_nopriv_ and its sole nonce gate is bypassable (the cdbbc_donation_box nonce is leaked to anonymous visitors in the wallets_data JS object from the [crypto-donation-box] shortcode). The scope-change (S:C) and C:L/I:L/A:N impacts correctly model stored XSS executing in other users' browser context rather than compromising the server directly. Exploitation status: no public exploit identified at time of analysis - there is no KEV listing and no POC flag in the input, so there is no evidence of active exploitation or weaponization. EPSS was not provided, so exploitation probability cannot be quantified. The authentication assessment is firmly grounded: PR:N confirms unauthenticated reachability, reinforced by the description's explicit nopriv/nonce-bypass mechanism. Net: a real, confirmable unauthenticated stored-XSS requiring remediation on affected sites, but its real-world blast radius is bounded by the plugin's limited footprint rather than by any technical difficulty of exploitation.

An unauthenticated attacker visits a public page containing the [crypto-donation-box] shortcode, scrapes the exposed cdbbc_donation_box nonce from the wallets_data JavaScript object, and sends a crafted cdbbc_payment_verify AJAX request with a malicious data_object value. The unsanitized payload is stored and later rendered in the plugin's admin donation list table (cdbbc-list-table.php), so the injected script executes in the browser of an administrator who views the donations page. No public exploit code is identified at time of analysis, but the attack path is fully described in the Wordfence advisory.