CVE-2025-7205 is a stored cross-site scripting vulnerability identified in the GiveWP Donation Plugin and Fundraising Platform for WordPress, affecting all versions up to and including 4.5.0. The vulnerability stems from improper neutralization of input during web page generation, specifically inadequate sanitization and escaping of the donor notes parameter. Authenticated attackers with worker-level access or higher can inject arbitrary JavaScript code into donor notes fields. When an administrator or other privileged user visits the affected page, the malicious script executes in their browser context, potentially allowing session hijacking, privilege escalation, or other malicious actions. Exploitation requires the attacker to be authenticated with sufficient privileges and to trick an administrator into visiting the compromised page, often on a legacy version of the site. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, privileges required at the worker level, and requiring user interaction. The impact affects confidentiality and integrity but not availability. No public exploits have been reported yet, but the risk remains significant due to the potential for administrative account compromise. No official patches or updates are linked yet, so mitigation may require manual input validation or restricting access until a fix is available.

This vulnerability can lead to unauthorized script execution in the context of administrative users, enabling attackers to hijack sessions, steal credentials, or perform actions with elevated privileges. Organizations using GiveWP for fundraising and donation management may face risks of data theft, manipulation of donation records, or unauthorized administrative actions. The exploitation could undermine trust in fundraising platforms, cause financial losses, and damage organizational reputation. Since the attack requires authenticated access at worker level or above, insider threats or compromised lower-privilege accounts pose a risk. The need for an administrator to visit the injected page means social engineering or phishing tactics could be used to trigger the exploit. While availability is not directly impacted, the confidentiality and integrity breaches can have serious operational and compliance consequences, especially for organizations handling sensitive donor information or financial transactions.

Organizations should immediately verify the version of GiveWP in use and upgrade to a patched version once available. Until a patch is released, implement strict input validation and output encoding on the donor notes field to prevent script injection. Restrict worker-level and higher privileges to trusted users only and monitor for unusual activity. Limit administrator access to legacy versions of the site or disable legacy site versions if possible. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious input patterns related to donor notes. Educate administrators about the risk of visiting untrusted or legacy pages and encourage cautious behavior regarding links and inputs. Regularly audit user privileges and logs for signs of exploitation attempts. Consider isolating or sandboxing administrative interfaces to reduce the impact of potential XSS attacks. Finally, maintain up-to-date backups and incident response plans to quickly recover from any compromise.