Stored Cross-Site Scripting Vulnerability in Charitable Donation Plugin for WordPress

CVE-2025-5275

What is CVE-2025-5275?

The Charitable – Donation Plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack through its privacy settings fields. This vulnerability, found in all versions up to and including 1.8.6.1, arises from inadequate input sanitization and output escaping. Authenticated attackers with administrator-level access can exploit this flaw to inject arbitrary web scripts into pages, which will execute whenever a user accesses the compromised page. This issue predominantly affects multi-site installations and those where unfiltered_html has been disabled. A partial fix was implemented in version 1.8.6.1, with a complete resolution provided in version 1.8.6.2.

References