CVE-2026-104394: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Syed Balkhi Charitable

This vulnerability (CVE-2026-104394) is an improper neutralization of input during web page generation (CWE-79) in the Charitable plugin for WordPress, versions up to and including 1.8.12.3. It allows unauthenticated attackers to perform Cross-Site Scripting (XSS) attacks, potentially enabling script injection that can affect users viewing the vulnerable pages. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially allowing attackers to steal user credentials, manipulate content, or disrupt availability. The vulnerability affects unauthenticated users, increasing the risk of exploitation. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS attempts and restrict user input where possible.