CVE-2026-93885: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations

CVE-2026-93885 is a stored cross-site scripting vulnerability in the Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin (versions up to 2.2.13). The flaw is due to improper neutralization of input during web page generation (CWE-79), specifically insufficient sanitization and escaping of the data_object parameter. The AJAX action cdbbc_payment_verify is registered for unauthenticated users (wp_ajax_nopriv_) and relies on a nonce for authentication. However, the nonce (cdbbc_donation_box) is publicly exposed via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode, allowing attackers to bypass the nonce check. This enables unauthenticated attackers to inject arbitrary JavaScript that executes in the context of users visiting the injected pages.

An unauthenticated attacker can inject malicious scripts into pages generated by the plugin, which execute in the browsers of users who visit those pages. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling or removing the plugin to prevent exploitation. Monitor official vendor channels for updates and apply any released fixes promptly.