The Double the Donation plugin (kanwei_doublethedonation) versions up to 2.0.0 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that execute when other users view the compromised content. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity), with network attack vector, low attack complexity, required privileges high, user interaction required, and impacts on confidentiality, integrity, and availability rated low. No patch or vendor advisory is provided, and no known exploits exist in the wild.

Successful exploitation of this stored XSS vulnerability could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and elevated privileges, reducing the overall risk. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and exercise caution with user-generated content. Monitor vendor channels for updates regarding patches or mitigations.