The vulnerability CVE-2025-58842 in the Donation Forms WP plugin by Givecloud is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker with low privileges and the ability to trick a user into interacting with malicious content to execute arbitrary scripts in the context of the affected site. The vulnerability affects versions up to 1.0.9. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability classified as low to low-medium. No patch or vendor advisory is provided in the data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to limited disclosure of sensitive information, modification of site content, or disruption of service. The impact is rated medium with a CVSS score of 6.5. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges for users who can submit input to the affected forms and apply web application firewall (WAF) rules that can detect and block XSS payloads. Monitor vendor communications for updates on patches or official mitigations.