CVE-2025-5275 identifies a stored cross-site scripting (XSS) vulnerability in the Charitable – Donation Plugin for WordPress, a plugin designed to facilitate fundraising with recurring donations. The vulnerability exists due to improper neutralization of input during web page generation (CWE-79), specifically within the privacy settings fields. In affected versions up to and including 1.8.6.1, the plugin fails to adequately sanitize and escape user-supplied input before rendering it in web pages. This flaw enables an attacker with administrator-level privileges to inject arbitrary JavaScript code that is stored persistently and executed whenever a user views the infected page. The vulnerability is limited to multisite WordPress installations or those where the unfiltered_html capability is disabled, which restricts HTML input filtering. The partial fix in version 1.8.6.1 addressed some aspects of the issue, but a complete resolution was only achieved in version 1.8.6.2. The CVSS 3.1 base score of 4.4 reflects a network attack vector with high attack complexity, requiring privileges and no user interaction, impacting confidentiality and integrity but not availability. No public exploits have been observed, but the vulnerability poses a risk of session hijacking, privilege escalation, or defacement if exploited. The plugin is widely used in WordPress environments focused on charitable fundraising, making the vulnerability relevant to organizations relying on this software for donation management.

The primary impact of this vulnerability is the potential compromise of confidentiality and integrity within affected WordPress sites. An attacker with administrator access can inject malicious scripts that execute in the context of other users, potentially stealing session cookies, performing unauthorized actions, or defacing content. This can lead to unauthorized access, data leakage, or reputational damage for organizations relying on the plugin for fundraising activities. Since the vulnerability requires administrator privileges, the initial compromise vector is limited; however, once exploited, it can affect all users accessing the infected pages. Multisite installations are particularly at risk due to the broader scope of user access. The vulnerability does not affect availability directly but can indirectly disrupt operations through trust erosion or administrative overhead. Organizations using this plugin in sectors such as non-profits, charities, and fundraising platforms worldwide could face targeted attacks aiming to undermine donor confidence or steal sensitive information.

To mitigate this vulnerability, organizations should immediately update the Charitable – Donation Plugin to version 1.8.6.2 or later, where the issue is fully resolved. Administrators should audit multisite WordPress installations and verify that unfiltered_html capabilities are appropriately configured to minimize risk. Implementing strict input validation and output encoding on all user-supplied data fields, especially in privacy settings, is critical. Additionally, restricting administrator access to trusted personnel and employing multi-factor authentication can reduce the risk of privilege abuse. Regular security audits and monitoring for unusual script injections or page modifications can help detect exploitation attempts early. Employing a Web Application Firewall (WAF) with rules targeting XSS payloads may provide an additional layer of defense. Backup procedures should be reviewed to ensure rapid recovery in case of compromise. Finally, educating administrators about the risks of stored XSS and safe plugin management practices will enhance overall security posture.