CVE-2024-12500 is a stored Cross-Site Scripting (XSS) vulnerability identified in the Philantro – Donations and Donor Management plugin for WordPress. The flaw exists in all versions up to and including 5.2 due to improper neutralization of input during web page generation, specifically in the handling of shortcode attributes such as 'donate'. The plugin fails to adequately sanitize and escape user-supplied input, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code into pages. When other users visit these pages, the injected scripts execute in their browsers, potentially compromising session tokens, redirecting users, or performing unauthorized actions on behalf of the victim. The vulnerability is exploitable remotely over the network without user interaction, with low attack complexity, but requires authenticated access at contributor level or above. The CVSS 3.1 base score is 6.4, reflecting a medium severity with partial impact on confidentiality and integrity but no impact on availability. No public exploits have been reported yet, but the vulnerability poses a significant risk to sites relying on this plugin for donation management. The issue stems from CWE-79, a common web application security weakness related to improper input validation and output encoding. Mitigation requires patching the plugin once an update is available or applying strict input validation and output escaping on shortcode attributes. Additionally, limiting contributor permissions and monitoring for suspicious activity can reduce risk.

The primary impact of CVE-2024-12500 is the potential compromise of user confidentiality and integrity on affected WordPress sites. Exploitation allows attackers with contributor-level access to inject persistent malicious scripts that execute in the context of any user visiting the infected page. This can lead to session hijacking, theft of sensitive information, unauthorized actions performed on behalf of users, and defacement of web content. For organizations, this can result in reputational damage, loss of donor trust, and potential data breaches. Since the vulnerability requires authenticated access, the risk is somewhat mitigated by access controls; however, contributor-level permissions are common in collaborative environments, increasing the attack surface. The vulnerability does not affect availability directly but can indirectly impact service reliability if exploited for defacement or redirection. Nonprofit organizations and fundraising platforms using Philantro are particularly at risk, as attackers may target these sites to disrupt donation processes or steal donor information. The medium CVSS score reflects a moderate but significant threat that warrants timely remediation to prevent exploitation.

To mitigate CVE-2024-12500, organizations should first check for and apply any official patches or updates released by the Philantro plugin developers addressing this vulnerability. In the absence of an immediate patch, administrators should restrict contributor-level permissions to trusted users only, minimizing the risk of malicious shortcode injection. Implementing Web Application Firewalls (WAFs) with rules to detect and block suspicious script injections in shortcode attributes can provide an additional layer of defense. Site owners should audit existing content for injected scripts and remove any suspicious code. Employing strict input validation and output encoding on all user-supplied shortcode attributes within the plugin code can prevent exploitation; this may require custom code adjustments if patches are unavailable. Monitoring logs for unusual contributor activity and scanning for XSS payloads can help detect attempted exploitation. Finally, educating contributors about secure content practices and the risks of injecting untrusted code can reduce accidental introduction of vulnerabilities.