Stored Cross-Site Scripting in Philantro Donations Plugin for WordPress

CVE-2024-13527

Summary

The Philantro Donations and Donor Management plugin for WordPress exhibits a vulnerability that allows stored cross-site scripting through the plugin's shortcodes like 'donate'. This issue exists across all versions up to and including 5.3, stemming from inadequate input sanitization and output escaping for user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this weakness to inject malicious scripts into pages. The injected scripts will execute whenever users visit the compromised pages, posing significant risks to website security and user safety.

References