Arbitrary Code Injection in Donation Thermometer Plugin by WordPress
CVE-2026-92409
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-92409?
The Donation Thermometer plugin for WordPress, prior to version 2.3.0, is vulnerable to arbitrary code injection due to the inadequate escaping of a color value from a shortcode attribute. This flaw enables users with Contributor role and higher to inject event handlers that execute when the page is viewed, potentially compromising the integrity of the website. It is crucial for site administrators to update to the latest version to mitigate this risk.
Affected Version(s)
Donation Thermometer 2.2.9 < 2.3.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.