Stored Cross-Site Scripting Vulnerability in Simple Donate Plugin for WordPress

CVE-2025-11882

What is CVE-2025-11882?

The Simple Donate plugin for WordPress is affected by a vulnerability that allows for Stored Cross-Site Scripting (XSS) through its simpledonate shortcode. This issue arises from inadequate input sanitization and output escaping applied to user-supplied attributes. Authenticated attackers, possessing contributor-level access or higher, can exploit this flaw to inject arbitrary web scripts. These scripts execute whenever unsuspecting users access the affected pages, potentially leading to unauthorized actions or exposure of sensitive information.

References