The Charitable WordPress plugin prior to version 1.8.5.3 contains a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a campaign image text field. This vulnerability permits users with elevated campaign-management privileges to inject malicious JavaScript code that is stored and later executed in the context of the front-end campaign page, potentially impacting confidentiality and integrity of user interactions.

Successful exploitation requires a user with high-privilege campaign-management rights to inject malicious scripts. The vulnerability can lead to execution of arbitrary scripts in the context of the front-end campaign page, resulting in limited confidentiality and integrity impacts. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege campaign-management roles to trusted users only and consider additional input validation or sanitization controls at the application level if feasible.