Klbtheme
Monthly
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. No public exploit has been identified at time of analysis, and EPSS/KEV data were not provided.
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in the KlbTheme Total Donations WordPress plugin affects versions up to and including 2.0.5 and lets an attacker plant persistent JavaScript that runs when a victim views a poisoned donation page, potentially compromising an administrator's browser session. The supplied CVSS score is 7.1, while our independent assessment rates the vector as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, noting that exploitation requires storing a payload and then having a victim render it; no public exploit was identified at time of analysis and no EPSS data was provided.
Privilege escalation in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated attackers promote themselves to full administrator, per Wordfence and Patchstack advisories. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates it Critical 9.8 with complete confidentiality, integrity, and availability impact. No public exploit code is identified at the time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable admin-takeover primitive makes it high priority.
SQL injection in the Total Donations WordPress plugin (all versions through 2.0.5) lets unauthenticated remote attackers inject additional SQL into existing queries to read arbitrary database contents, including user credentials and secrets. The flaw stems from an unescaped, unprepared user-supplied parameter and carries a 9.8 CVSS. No public exploit has been identified at time of analysis, but the unauthenticated network vector makes this a high-priority patching target for any site still running the plugin.
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. No public exploit has been identified at time of analysis, and EPSS/KEV data were not provided.
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.