Total Donations EUVD-2026-95631

Exploitation requires (1) the ability to store the malicious payload - for WordPress stored XSS this normally means at least a low-privilege authenticated account or access to an exposed injection point, though the supplied CVSS lists PR:N; and (2) a victim subsequently rendering the affected page (UI:R), such as an administrator browsing donation data. It affects Total Donations installations up to and including version 2.0.5. Limiting factors: the dependence on a victim viewing the poisoned content and the plugin's small deployment footprint substantially narrow realistic exploitation.

This is a moderate-severity Stored XSS (CWE-79) in the Total Donations WordPress plugin, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network vector, low complexity, and scope change (S:C) elevate the score, reflecting that injected script executes in a victim's authenticated browser session against a different security context. However, several signals temper real-world urgency: no EPSS score was provided, there is no CISA KEV listing, and no public POC was referenced - only a Patchstack database entry. A notable conflict exists in the supplied data: the vector lists PR:N (unauthenticated), yet stored XSS in WordPress plugins - and Patchstack's own classifications - typically require at least low-privilege authenticated access (e.g., contributor/author) to persist the payload; the PR:N rating should be verified, as it likely overstates ease of injection. The partial impact ratings (C:L/I:L/A:L) are consistent with typical XSS consequences (session/token theft, limited defacement) rather than full system compromise. Net assessment: a real but not emergency-level issue - prioritize patching for sites running this plugin, but the lack of exploitation evidence and the user-interaction requirement (UI:R) make widespread opportunistic exploitation unlikely.

An attacker with the ability to submit or store content (or who abuses an injection point in donation-related input) plants a malicious JavaScript payload in a field persisted by Total Donations ≤2.0.5. When an administrator or other user later views the affected page in wp-admin or on the front end, the script executes in their browser context, enabling session hijacking or actions on their behalf. No public exploit code was identified, and successful exploitation depends on a victim viewing the poisoned page (UI:R).