Donation Thermometer EUVD-2026-100863

Exploitation requires an authenticated WordPress account with the Contributor role or higher on the target site, and the Donation Thermometer plugin (version 2.2.9 up to but excluding 2.3.0) must be installed and its shortcode usable by that user. The attacker must supply a malicious colour value through the shortcode attribute, which is placed unescaped into a legend element attribute. Execution additionally requires a victim (typically an administrator or editor) to view or preview the page containing the stored payload (UI:R). Limiting factors: this is NOT remotely exploitable by anonymous visitors - single-author or tightly-controlled sites where all contributors are trusted face minimal practical risk; sites allowing untrusted or open contributor registration are the realistic exposure.

This is a stored/persistent Cross-Site Scripting flaw (CWE-79) requiring an authenticated attacker with at least Contributor-level access. The provider CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, 6.8) is internally inconsistent with the description in two ways worth flagging: (1) the description states 'Contributor role and above,' which is a LOW-privilege WordPress role, yet the vector encodes PR:H - Contributor normally maps to PR:L; and (2) it rates C:H/I:H/A:H with S:U, which is unusually high for a shortcode-based XSS where injected JavaScript executes in the viewing user's browser (typical WPScan stored-XSS ratings are limited C/I impact with a scope change). Real-world risk signals are muted: EPSS is only 0.18% (8th percentile) and the vulnerability is NOT on CISA KEV, indicating no evidence of widespread automated exploitation. Public exploit code exists (WPScan), which raises opportunistic risk, but the Contributor-or-above prerequisite and victim interaction requirement (UI:R) substantially constrain exploitability to multi-author sites where untrusted contributors exist. Net: a genuine but moderate, conditional issue - not an emergency - best treated as a routine patch priority rather than a drop-everything event.

On a multi-author WordPress site, an attacker holding a Contributor account inserts the Donation Thermometer shortcode with a malicious colour attribute containing an event handler (e.g. a crafted value breaking out into an onmouseover/onload handler). When an administrator or other user previews or views the page containing that shortcode, the injected JavaScript executes in their browser session. Public exploit code for this technique is available via WPScan.