The Charitable WordPress plugin versions prior to 1.8.5.3 contain a stored XSS vulnerability (CWE-79) due to improper sanitization and escaping of a campaign image text field. This flaw permits high-privilege users managing campaigns to inject malicious code that is stored and executed when the campaign page is viewed, potentially compromising site visitors.

An attacker with high-level campaign management privileges can inject malicious scripts into the campaign image text field. These scripts execute in the browsers of users who visit the affected campaign pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not appear to be exploitable by low-privilege users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.8.5.3, upgrading to version 1.8.5.3 or later (once confirmed) is recommended. In the absence of an official fix, restrict campaign management privileges to trusted users only to reduce risk.